CVE-2026-59871: node-tar Path Handling TypeError Vulnerability

CVE-2026-59871 Overview

CVE-2026-59871 affects node-tar, a widely used tar archive manipulation library for Node.js. Versions prior to 7.5.18 coerce all-digit PAX path and linkpath values into JavaScript numbers within src/pax.ts. Downstream path handling code such as normalizeWindowsPath(entry.path).split('/') then throws an uncaught TypeError when it receives a number instead of a string. The flaw is categorized as an improper type conversion issue [CWE-704] and can be triggered remotely by supplying a crafted tar archive. Version 7.5.18 resolves the issue by parsing PAX values according to their known types and hardening normalizeWindowsPath to accept unknown inputs.

Critical Impact
A crafted tar archive containing all-digit PAX path or linkpath values causes an uncaught TypeError during extraction, disrupting availability of applications that process untrusted archives.

Affected Products

node-tar versions prior to 7.5.18
Node.js applications and tooling that consume node-tar to extract untrusted tar archives
Build pipelines and package managers relying on vulnerable node-tar releases

Discovery Timeline

2026-07-08 - CVE-2026-59871 published to NVD
2026-07-08 - Last updated in NVD database
v7.5.18 - Fix released via GitHub Release v7.5.18 and GHSA-w8wr-v893-vjvp

Technical Details for CVE-2026-59871

Vulnerability Analysis

The vulnerability stems from improper type coercion in the PAX header parser. In src/pax.ts, the parseKVLine reducer used parseInt(line, 10) and stored resulting values without preserving the expected string type for path fields. When a PAX extended header supplied an all-digit value for path or linkpath, node-tar exposed that value as a JavaScript number on the entry object. Consumers of the entry — including internal calls like normalizeWindowsPath(entry.path).split('/') — assumed a string and invoked string methods on a number, raising an uncaught TypeError. Applications that do not wrap tar extraction in defensive error handling crash on the offending archive, resulting in denial of service for the processing task.

Root Cause

The root cause is an improper type conversion [CWE-704]. The PAX key/value parser did not distinguish fields by expected type. All-digit strings were converted to numbers regardless of whether the field semantically required a string (such as filesystem paths).

Attack Vector

An attacker supplies a crafted tar archive containing a PAX extended header where path or linkpath is set to an all-digit value. When a vulnerable node-tar version extracts or lists the archive, path normalization throws TypeError: p.replaceAll is not a function or a similar error, terminating the operation. Exploitation requires no authentication and no user interaction beyond triggering archive processing.

typescript

// Patch: src/pax.ts — parse values according to known types
-const parseKVLine = (set: Record<string, unknown>, line: string) => {
+const parseKVLine = (
+  set: Record<string, string | number | Date>,
+  line: string,
+) => {
   const n = parseInt(line, 10)

   // XXX Values with \n in them will fail this.

// Patch: src/normalize-windows-path.ts — accept unknown and coerce to string
-export const normalizeWindowsPath =
+export const normalizeWindowsPath: (p: unknown) => string =
   platform !== 'win32' ?
-    (p: string) => p
-  : (p: string) => p && p.replaceAll(/\\/g, '/')
+    (p: unknown) => String(p)
+  : (p: unknown) => String(p).replaceAll(/\\/g, '/')

Source: GitHub commit e02a4e9

Detection Methods for CVE-2026-59871

Indicators of Compromise

Uncaught TypeError originating from normalizeWindowsPath or .split('/') calls in stack traces referencing node-tar
Crashes or hung workers in services that extract user-supplied tar archives
Tar archives containing PAX extended headers with numeric-only path or linkpath values

Detection Strategies

Inventory Node.js projects and container images for tar package versions below 7.5.18 using npm ls tar or SBOM tooling
Add error-boundary logging around tar extraction routines to capture and forward TypeError events with archive identifiers
Scan incoming archives for PAX headers where path or linkpath matches ^\d+$ before passing to extraction

Monitoring Recommendations

Alert on repeated node-tar extraction failures from the same source, tenant, or upload endpoint
Monitor CI/CD, package registry, and artifact ingestion services for unhandled exceptions during archive processing
Track dependency updates in application manifests to confirm remediated node-tar versions reach production

How to Mitigate CVE-2026-59871

Immediate Actions Required

Upgrade node-tar to version 7.5.18 or later across all direct and transitive dependencies
Run npm audit and npm ls tar to identify nested versions pinned by other packages
Rebuild and redeploy container images and serverless bundles that embed node-tar

Patch Information

The fix is available in node-tar 7.5.18. See GitHub Release v7.5.18, the GHSA-w8wr-v893-vjvp advisory, and the remediation commit. The patch parses PAX values by known type and updates normalizeWindowsPath to coerce any input to a string before manipulation.

Workarounds

Wrap tar extraction calls in try/catch blocks to prevent process termination from unhandled TypeError exceptions
Reject or quarantine archives whose PAX path or linkpath entries contain only digits prior to extraction
Restrict archive processing to trusted sources until the upgrade to 7.5.18 is deployed

bash

# Update to the patched version
npm install tar@^7.5.18

# Verify no vulnerable nested versions remain
npm ls tar

# Force resolution for transitive dependencies (npm >= 8)
npm install --save tar@7.5.18