Read the docs
TI-2026-42688 Aliases CVE-2026-59874GHSA-8x88-c5mf-7j5w

node-tar: Negative tar entry size causes infinite loop in archive replace

Priority HIGH 77CWE-835Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 22 fixed, 12 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-835.

Summary

node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00434 37th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial node-tar (isaacs): 7.5.18tar (npm): 7.5.18Red Hat: 26 advisoriesRed Hat: 22 fixed, 12 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
isaacsnode-tarbefore 7.5.187.5.18Patch availableCNA
—tar (npm)before 7.5.187.5.18Patch availableGHSA-8x88-c5mf-7j5w
  • node-tar Vendorisaacs Affected before 7.5.18 Fixed in 7.5.18 Patch available CNA
  • tar (npm) Vendor— Affected before 7.5.18 Fixed in 7.5.18 Patch available GHSA-8x88-c5mf-7j5w

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:isaacs:tar:*:*:*:*:*:node.js:*:*before 7.5.18Vulnerableisaacs
  • cpe:2.3:a:isaacs:tar:*:*:*:*:*:node.js:*:* Versions before 7.5.18 Vulnerable ·isaacs

Remediation

  • Fix · CNA node-tar (isaacs) Fixed in 7.5.18
  • Fix · GHSA-8x88-c5mf-7j5w tar (npm) Fixed in 7.5.18 Advisory →

Red Hat 26 advisories

  • RHSA-2026:84734 Released 2026-10-19 · Red Hat rating Critical
    RHOAI 3.4.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
  • RHSA-2026:83598 Released 2026-10-15 · Red Hat rating Important
    RHTAS 1.4.4 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/certificate-transparency-rhel9, registry.redhat.io/rhtas/fulcio-rhel9, registry.redhat.io/rhtas/rekor-backfill-redis-rhel9 +6
  • RHSA-2026:73987 Released 2026-09-30 · Red Hat rating Critical
    RHOAI 3.3.7 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +47
Show 23 more Red Hat advisories
  • RHSA-2026:68681 Released 2026-09-17 · Red Hat rating Important
    Migration Toolkit for Containers (MTC) 1.8.17 update
    • Red Hat Migration Toolkit 1.8 registry.redhat.io/rhmtc/openshift-migration-registry-rhel8, registry.redhat.io/rhmtc/openshift-migration-ui-rhel8
  • RHSA-2026:66545 Released 2026-09-10 · Red Hat rating Important
    Red Hat AMQ Broker 7.13.6 release and security update
    • Red Hat AMQ Broker 7.13.6
  • RHSA-2026:66488 Released 2026-09-10 · Red Hat rating Important
    Red Hat AMQ Broker 7.14.1 release and security update
    • Red Hat AMQ Broker 7.14.1
  • RHSA-2026:65126 Released 2026-09-08 · Red Hat rating Important
    RHOAI 2.25.11 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
  • RHSA-2026:63371 Released 2026-09-03 · Red Hat rating Important
    General availability of the satellite/iop-remediations-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-remediations-rhel9
  • RHSA-2026:62260 Released 2026-09-01 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.30.0 Release.
    • Red Hat OpenShift Dev Spaces 3.30 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/configbump-rhel9, registry.redhat.io/devspaces/dashboard-rhel9 +7
  • RHSA-2026:60520 Released 2026-08-27 · Red Hat rating Critical
    RHOAI 3.4.4 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9 +47
  • RHSA-2026:57590 Released 2026-08-20 · Red Hat rating Important
    rh-podman-desktop security, bug fix, and enhancement update
    • Red Hat Enterprise Linux Extensions Channel (v. 10) rh-podman-desktop-1.1.2-1.el10_2
  • RHSA-2026:53298 Released 2026-08-11 · Red Hat rating Important
    nodejs22 security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) nodejs-1:22.23.1-3.el10_0, nodejs-devel-1:22.23.1-3.el10_0, nodejs-docs-1:22.23.1-3.el10_0 +4
  • RHSA-2026:52399 Released 2026-08-10 · Red Hat rating Important
    nodejs:22 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22, nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22, nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22 +28
  • RHSA-2026:51200 Released 2026-08-06 · Red Hat rating Important
    General availability of the satellite/iop-remediations-rhel9 container image
    • Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-remediations-rhel9
  • RHSA-2026:49689 Released 2026-08-03 · Red Hat rating Important
    Kiali 2.11.15 for Red Hat OpenShift Service Mesh 3.1
    • Red Hat OpenShift Service Mesh 3.1 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
  • RHSA-2026:49687 Released 2026-08-03 · Red Hat rating Important
    Kiali 2.4.21 for Red Hat OpenShift Service Mesh 3.0
    • Red Hat OpenShift Service Mesh 3.0 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
  • RHSA-2026:49681 Released 2026-08-03 · Red Hat rating Important
    Kiali 2.17.12 for Red Hat OpenShift Service Mesh 3.2
    • Red Hat OpenShift Service Mesh 3.2 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
  • RHSA-2026:49680 Released 2026-08-03 · Red Hat rating Important
    Kiali 2.22.8 for Red Hat OpenShift Service Mesh 3.3
    • Red Hat OpenShift Service Mesh 3.3 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
  • RHSA-2026:47057 Released 2026-08-03 · Red Hat rating Important
    nodejs:24 security update
    • Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:24.18.0-3.module+el9.8.0+24537+83ec84e1.aarch64::nodejs:24, nodejs-1:24.18.0-3.module+el9.8.0+24537+83ec84e1.ppc64le::nodejs:24, nodejs-1:24.18.0-3.module+el9.8.0+24537+83ec84e1.s390x::nodejs:24 +25
  • RHSA-2026:47058 Released 2026-08-03 · Red Hat rating Important
    nodejs:22 security update
    • Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:22.23.1-2.module+el9.8.0+24538+3f176d52.aarch64::nodejs:22, nodejs-1:22.23.1-2.module+el9.8.0+24538+3f176d52.ppc64le::nodejs:22, nodejs-1:22.23.1-2.module+el9.8.0+24538+3f176d52.s390x::nodejs:22 +28
  • RHSA-2026:48124 Released 2026-07-29 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.29.1 Release.
    • Red Hat OpenShift Dev Spaces 3.29 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/jetbrains-ide-rhel9 +2
  • RHSA-2026:48033 Released 2026-07-29 · Red Hat rating Important
    nodejs22 security update
    • Red Hat Enterprise Linux AppStream (v. 10) nodejs-1:22.23.1-4.el10_2, nodejs-devel-1:22.23.1-4.el10_2, nodejs-docs-1:22.23.1-4.el10_2 +4
  • RHSA-2026:48034 Released 2026-07-29 · Red Hat rating Important
    nodejs24 security update
    • Red Hat Enterprise Linux AppStream (v. 10) nodejs24-1:24.18.0-3.el10_2, nodejs24-devel-1:24.18.0-3.el10_2, nodejs24-docs-1:24.18.0-3.el10_2 +3
  • RHSA-2026:47059 Released 2026-07-28 · Red Hat rating Important
    nodejs:22 security update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:22.23.1-2.module+el8.10.0+24556+e9352af2.aarch64::nodejs:22, nodejs-1:22.23.1-2.module+el8.10.0+24556+e9352af2.ppc64le::nodejs:22, nodejs-1:22.23.1-2.module+el8.10.0+24556+e9352af2.s390x::nodejs:22 +28
  • RHSA-2026:47060 Released 2026-07-28 · Red Hat rating Important
    nodejs:24 security update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:24.18.0-2.module+el8.10.0+24562+090c6525.aarch64::nodejs:24, nodejs-1:24.18.0-2.module+el8.10.0+24562+090c6525.ppc64le::nodejs:24, nodejs-1:24.18.0-2.module+el8.10.0+24562+090c6525.s390x::nodejs:24 +25
  • RHSA-2026:42815 Released 2026-07-21 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.2 security update
    • Red Hat Ansible Automation Platform 2.2 registry.redhat.io/ansible-automation-platform/automation-portal

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Confidential Compute AttestationAffectedNo fix planned: Will not fix
Exploit IntelligenceAffectedNo fix yet
Node HealthCheck OperatorAffectedNo fix yet
OpenShift PipelinesAffectedNo fix yet
Red Hat Build of Podman DesktopAffectedNo fix yet
Red Hat Connectivity Link 1AffectedNo fix yet
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet
Red Hat Openshift Data Foundation 4AffectedNo fix yet
Red Hat Single Sign-On 7AffectedNo fix planned: Will not fix
Red Hat build of Apache Camel - HawtIO 4AffectedNo fix yet
Red Hat AMQ Broker 7.13.6Fixed RHSA-2026:66545
Red Hat AMQ Broker 7.14.1Fixed RHSA-2026:66488
Red Hat Ansible Automation Platform 2.2Fixed RHSA-2026:42815
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:48033, RHSA-2026:48034
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:47059, RHSA-2026:47060
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:47057, RHSA-2026:47058
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:53298
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:52399
Red Hat Enterprise Linux Extensions Channel (v. 10)Fixed RHSA-2026:57590
Red Hat Migration Toolkit 1.8Fixed RHSA-2026:68681
Red Hat OpenShift AI 2.25Fixed RHSA-2026:65126
Red Hat OpenShift AI 3.3Fixed RHSA-2026:73987
Red Hat OpenShift AI 3.4Fixed RHSA-2026:60520, RHSA-2026:84734
Red Hat OpenShift Dev Spaces 3.29Fixed RHSA-2026:48124
Red Hat OpenShift Dev Spaces 3.30Fixed RHSA-2026:62260
Red Hat OpenShift Service Mesh 3.0Fixed RHSA-2026:49687
Red Hat OpenShift Service Mesh 3.1Fixed RHSA-2026:49689
Red Hat OpenShift Service Mesh 3.2Fixed RHSA-2026:49681
Red Hat OpenShift Service Mesh 3.3Fixed RHSA-2026:49680
Red Hat Satellite 6.18Fixed RHSA-2026:63371
Red Hat Satellite 6.19Fixed RHSA-2026:51200
Red Hat Trusted Artifact Signer 1.4Fixed RHSA-2026:83598
Not affected: 24 products
  • Cryostat 4
  • Red Hat 3scale API Management Platform 2
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Developer Hub 1
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Hardened Images
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Migration Toolkit 1.8
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift AI 3.3
  • Red Hat OpenShift AI 3.4
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 5
  • Red Hat OpenShift Dev Spaces
  • Red Hat OpenShift Dev Spaces 3.29
  • Red Hat OpenShift Dev Spaces 3.30
  • Red Hat Trusted Artifact Signer 1.4
  • Red Hat build of Apache Camel for Spring Boot 4
  • Self-service automation portal 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-59874
  2. 2026-10-03 Alias added: GHSA-8x88-c5mf-7j5w
  3. 2026-10-07 Fix available: RHSA-2026:73987 · Red Hat
  4. 2026-10-16 Fix available: RHSA-2026:83598 · Red Hat
  5. 2026-10-16 Fix available: Red Hat Trusted Artifact Signer 1.4 · Red Hat
  6. 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
  7. 2026-10-20 Affected versions changed · Red Hat
  8. 2026-10-27 Affected versions changed · Red Hat
  9. 2026-10-30 Affected versions changed · Red Hat

References

Exploit 1

Patch 1

Advisory 1

Other 2

  • TI-2026-42687 node-tar: Decompression/parse DoS via unlimited input CVSS 4.0CRITICAL 9.2
  • TI-2026-42686 node-tar: Process crash via PAX numeric path type confusion CVSS 3.1HIGH 7.5
  • TI-2026-24357 node-tar Symlink Path Traversal via Drive-Relative Linkpath CVSS 4.0HIGH 8.2
  • TI-2026-23372 node-tar: Hardlink Path Traversal via Drive-Relative Linkpath CVSS 4.0HIGH 8.2
  • TI-2026-20041 node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal CVSS 3.1HIGH 8.2
  • TI-2026-19118 node-tar Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization CVSS 4.0HIGH 8.2
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences