CVE-2026-59875
Fixed in a distro release EPSS <1%CVSS 5.3
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.lstat or fs.open and terminate the process with an uncaught exception. This issue is fixed in version 7.5.17.
Products: isaacs node-tar
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | tar | 7.5.17 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | actions-runner | 2.336.0-r1 |
| Chainguard | code-server | 4.129.0-r1 |
| Chainguard | gitlab-rails-ce-18.1 | 18.1.6-r31 |
| Chainguard | gitlab-rails-ce-18.10 | no fix |
| Chainguard | gitlab-rails-ce-18.6 | no fix |
| Chainguard | gitlab-rails-ce-18.7 | no fix |
| Chainguard | gitlab-rails-ce-18.8 | no fix |
| Chainguard | gitlab-rails-ce-18.9 | no fix |
| Chainguard | gitlab-rails-ce-19.0 | 19.0.4-r10 |
| Chainguard | gitlab-rails-ce-19.1 | 19.1.2-r8 |
| Chainguard | gitlab-rails-ce-19.2 | 19.2.2-r2 |
| Chainguard | gitlab-rails-ce-fips-18.1 | 18.1.6-r61 |
| Chainguard | gitlab-rails-ce-fips-18.10 | 18.10.8-r8 |
| Chainguard | gitlab-rails-ce-fips-18.11 | 18.11.12-r2 |
| Chainguard | gitlab-rails-ce-fips-18.6 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.7 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.8 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.9 | 18.9.8-r8 |
| Chainguard | gitlab-rails-ce-fips-19.0 | 19.0.4-r7 |
| Chainguard | gitlab-rails-ce-fips-19.1 | 19.1.2-r9 |
| Chainguard | gitlab-rails-ce-fips-19.2 | 19.2.1-r4 |
| Chainguard | graalvm-25-ce-nodejs | 25.0.4-r2 |
| Chainguard | jupyter-base-notebook | 7.6.3-r2 |
| Chainguard | kibana-9.2 | 9.2.8-r17 |
| Chainguard | kibana-9.2-iamguarded | 9.2.8-r17 |
| Chainguard | kubeflow-centraldashboard | 1.10.0-r25 |
| Chainguard | lerna | 9.0.7-r11 |
| Chainguard | npm | 12.0.0-r1 |
| Chainguard | opensearch-dashboards-2 | 2.19.6-r4 |
| Chainguard | opensearch-dashboards-2-fips | 2.19.5-r18 |
| Chainguard | pnpm-stage0 | no fix |
| Chainguard | prism | 5.16.0-r1 |
| Chainguard | pulumi-language-nodejs | 3.253.0-r2 |
| Chainguard | saf | 1.6.0-r3 |
| Chainguard | sqlpad | 7.5.7-r29 |
| Chainguard | tensorflow-gpu-jupyter | 2.21.0-r12 |
| Chainguard | wazuh-dashboard | 4.14.6-r6 |
| Chainguard | wazuh-dashboard-fips | 4.14.6-r4 |
| Debian 12 | node-tar | no fix |
| Debian 13 | node-tar | no fix |
| Debian 14 | node-tar | 7.5.19+~4.0.1-1 |
| Ubuntu 18.04 LTS | node-tar | no fix |
| Ubuntu 22.04 LTS | node-tar | no fix |
| Ubuntu 24.04 LTS | node-tar | no fix |
| Ubuntu 25.10 | node-tar | no fix |
| Ubuntu 26.04 LTS | node-tar | no fix |
| Ubuntu 26.10 | node-tar | no fix |
| Ubuntu Pro 14.04 LTS | node-tar | no fix |
| Ubuntu Pro 16.04 LTS | node-tar | no fix |
| Ubuntu Pro 20.04 LTS | node-tar | no fix |
| Wolfi | code-server | 4.129.0-r1 |
| Wolfi | jupyter-base-notebook | 7.6.3-r2 |
| Wolfi | kubeflow-centraldashboard | 1.10.0-r25 |
| Wolfi | lerna | 9.0.7-r11 |
| Wolfi | npm | 12.0.0-r1 |
| Wolfi | pnpm-stage0 | no fix |
| Wolfi | prism | 5.16.0-r1 |
| Wolfi | pulumi-language-nodejs | 3.253.0-r2 |
| Wolfi | saf | 1.6.0-r3 |
| Wolfi | sqlpad | 7.5.7-r29 |