CVE-2026-59875

node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records

State: Published
Severity: 5.3 Medium
Published: Jul 8, 2026
Updated: Jul 9, 2026
Reserved: Jul 7, 2026

Description

node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.lstat or fs.open and terminate the process with an uncaught exception. This issue is fixed in version 7.5.17.

Scores

CVSS	Score	Vector	Source
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L	GitHub_M

Weaknesses

CWE-248 Uncaught Exception

Affected Products

Product	Versions
node-tarisaacs	< 7.5.17Affected

References

https://github.com/isaacs/node-tar/security/advisories/GHSA-gvwx-54wh-qm9j
https://github.com/isaacs/node-tar/commit/7a635c29f5edbf083557374d43984273ecfed5b3
https://github.com/isaacs/node-tar/releases/tag/v7.5.17

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.