CVE-2026-59874High· 7.5▾ TwilightA flaw was found in node-tar, a tar archive manipulation library for Node.js. A remote attacker could exploit this vulnerability by providing a specially crafted tar archive with a negative entry size in its header. This malformed header c…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 2.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.4%
0.4% → 0.6%
Last analysed / modified upstream
A flaw was found in node-tar, a tar archive manipulation library for Node.js. A remote attacker could exploit this vulnerability by providing a specially crafted tar archive with a negative entry size in its header. This malformed header causes the archive scanner to enter an infinite loop, repeatedly parsing the same header and preventing further processing. This can lead to a denial of service (DoS) condition, making the affected system or application unresponsive.
tar: Node-tar: Denial of Service via malformed tar archive header — rated Important by Red Hat. Released 2026-07-08, updated 2026-10-19.
Affected:
Fixed:
No fix planned:
Not affected:
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:53298 For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:48033 For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:48034
Workarounds / mitigations:
Affected packages:
tar <= 7.5.17Patched in:
tar 7.5.18Connected by shared product, vendor, weakness, or advisory.
CVE-2026-59873High· 7.5tar: node-tar: Denial of Service via crafted gzip bomb (CVE-2026-59873)
CVE-2026-19484High· 7.5fastify/busboy: fastify/busboy: Denial of Service via oversized multipart boundary (CVE-2026-19484)
CVE-2026-69192High· 8.6ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript
CVE-2026-48712High· 7.5protobufjs: protobufjs: Denial of Service via uncontrolled recursion with crafted protobuf payload (CVE-2026-48712)
CVE-2026-81724High· 7.5nltk: NLTK: Denial of Service via Uncontrolled Recursion (CVE-2026-81724)
CVE-2026-81722High· 7.5nltk: nltk PorterStemmer: Denial of Service due to inefficient token processing (CVE-2026-81722)