CVE-2026-59871: node-tar Process Crash via PAX Numeric Path Type Confusion
Summary
CVE-2026-59871: node-tar: Process crash via PAX numeric path type confusion. Affects tar versions < 7.5.18. Fixed in 7.5.18. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
node-tar is a widely used npm package that facilitates the creation and extraction of tar archives in Node.js applications. It is essential for managing package installations and file uploads. However, it has a vulnerability that allows crafted tar files to crash any Node.js process that attempts to extract them, posing a significant risk to applications relying on this package.
Vulnerability Detail
The vulnerability arises from the PAX header parser in node-tar, which incorrectly converts all-digit path values into JavaScript numbers. This conversion leads to a TypeError when the downstream code attempts to call the .split('/') method on the numeric value. The error is uncaught, causing the Node.js process to crash. This issue affects various entry types, including Directory, SymbolicLink, and Link, leading to denial of service for any application that extracts untrusted tar archives.
How To Fix
Latest published version: 7.5.22 as of 22 Oct 2026
npm install tar@7.5.22Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.5.18
This is the first release that contains the fix.
npm install tar@7.5.18Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid extracting tar archives from untrusted sources. If you must extract such archives, consider implementing additional validation checks on the paths before processing them.
Conclusion
The node-tar package has a critical vulnerability that can lead to process crashes when extracting malicious tar archives. It is crucial to update to the patched version 7.5.18 to mitigate this risk. Additionally, using tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for tar →
FAQ
The vulnerability allows crafted tar files to crash Node.js processes due to a TypeError caused by numeric path values in PAX headers.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can also use the Vulert playground to analyze your package-lock.json file.
The primary impact is denial of service, as any application that extracts untrusted tar archives can crash from a single malicious file.
Yes, the vulnerability has been patched in node-tar version 7.5.18. Updating to this version will resolve the issue.
If immediate updates are not possible, avoid extracting tar files from untrusted sources and implement validation checks on paths before processing.
References
Related vulnerabilities
Recent vulnerabilities recorded for tar.
