CVE-2026-59874: node-tar DOS Vulnerability

CVE-2026-59874 Overview

CVE-2026-59874 affects node-tar, a widely used tar archive manipulation library for Node.js. The flaw exists in the tar.replace operation, which accepts a checksum-valid tar header containing a negative base-256 encoded entry size. When the archive scanner encounters such a header, it fails to advance and repeatedly parses the same header, producing an infinite loop [CWE-835]. The condition results in a denial of service against any Node.js application that processes untrusted tar archives with the vulnerable API. Maintainers addressed the issue in version 7.5.18.

Critical Impact
A remote attacker can supply a crafted tar archive that causes node-tar to enter an infinite parsing loop, exhausting CPU resources and blocking the Node.js event loop.

Affected Products

node-tar versions prior to 7.5.18
Node.js applications and CLI tools that invoke tar.replace on untrusted archives
Downstream packages bundling vulnerable node-tar releases

Discovery Timeline

2026-07-08 - CVE-2026-59874 published to NVD
2026-07-08 - Last updated in NVD database
2026-07-08 - GitHub Security Advisory GHSA-8x88-c5mf-7j5w published
2026-07-08 - Fix released in node-tar v7.5.18

Technical Details for CVE-2026-59874

Vulnerability Analysis

The node-tar library parses tar archives entry by entry, using the header's size field to determine how many bytes to consume before locating the next header. Tar headers support a base-256 encoded numeric format for values that do not fit in the standard octal ASCII field. The parser converts this base-256 value into a signed JavaScript number without validating that the result is non-negative.

When tar.replace reads a header whose base-256 encoded size decodes to a negative integer, the scanner advances the read pointer by that negative amount. This effectively rewinds or leaves the offset unchanged, causing the same header to be parsed repeatedly. The checksum in the crafted header is valid, so the parser does not reject the entry before the loop begins.

Root Cause

The root cause is missing input validation on the decoded size field in src/header.ts and on the PAX size extended attribute in src/pax.ts. Neither location enforced a lower bound of zero on the parsed value, permitting negative sizes to propagate into scanner arithmetic and produce an unterminated loop [CWE-835].

Attack Vector

The attack requires no authentication, no user interaction, and can be triggered over the network wherever an application accepts and processes an attacker-controlled tar archive with tar.replace. The resulting infinite loop consumes a CPU core and stalls the Node.js event loop, preventing the process from serving other requests.

typescript

// Patch: src/header.ts - reject negative decoded header sizes
 import type { EntryTypeCode, EntryTypeName } from './types.js'
 import * as types from './types.js'

+const notNegative = (n?: number): number | undefined =>
+  n === undefined || n < 0 ? undefined : n
+
 export type HeaderData = {
   path?: string
   mode?: number
// Source: https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5

typescript

// Patch: src/pax.ts - only accept non-negative size in PAX extended headers
     case 'uname':
       set[k] = v
       break
+    case 'ctime':
     case 'atime':
     case 'mtime':
-    case 'ctime':
       set[k] = new Date(Number(v) * 1000)
       break
+    case 'size':
+      const s = +v
+      if (s >= 0) set[k] = s
+      break
     case 'gid':
     case 'uid':
     case 'dev':
     case 'ino':
     case 'nlink':
-    case 'size':
     case 'mode':
       set[k] = +v
       break
// Source: https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5

Detection Methods for CVE-2026-59874

Indicators of Compromise

A Node.js worker or process pinned at 100% CPU while handling a tar archive upload or update operation.
Request timeouts on endpoints that invoke tar.replace against user-supplied archives.
Tar archives containing headers with the high bit set on the size field (base-256 encoding) and decoded values less than zero.

Detection Strategies

Inventory Node.js applications and dependencies with npm ls tar to identify versions of node-tar below 7.5.18.
Inspect archive-processing code paths for calls to tar.replace that operate on externally sourced tar files.
Add pre-parse validation that rejects tar headers whose decoded size field is negative before handing data to node-tar.

Monitoring Recommendations

Alert on sustained single-core CPU saturation in Node.js processes correlated with archive upload endpoints.
Monitor event loop lag metrics (perf_hooks or APM tooling) for sudden, sustained blocking on tar-handling services.
Log the size and origin of tar archives submitted to the application and flag anomalies such as unusually small archives that consume unbounded processing time.

How to Mitigate CVE-2026-59874

Immediate Actions Required

Upgrade node-tar to version 7.5.18 or later in all direct and transitive dependencies.
Rebuild and redeploy container images and serverless bundles that ship the vulnerable library.
Audit application code for tar.replace usage on untrusted input and place processing behind resource limits.

Patch Information

The fix is available in node-tar release v7.5.18. The corresponding source change is documented in commit 9e78bf0, which adds a notNegative guard in src/header.ts and enforces a non-negative size in the PAX extended header parser in src/pax.ts. Full advisory details are published in GHSA-8x88-c5mf-7j5w.

Workarounds

Isolate tar processing in a worker thread or child process with a strict wall-clock timeout so an infinite loop can be terminated.
Reject archives whose header size fields use base-256 encoding with the sign bit set, or validate decoded sizes are non-negative before passing to node-tar.
Avoid tar.replace on attacker-controlled archives; use extract-then-repack workflows in a sandbox where feasible.

bash

# Update node-tar to the patched release
npm install tar@^7.5.18

# Verify no vulnerable versions remain in the dependency tree
npm ls tar | grep -E 'tar@([0-6]\.|7\.[0-4]\.|7\.5\.[0-9]$|7\.5\.1[0-7]$)'

# Audit against the advisory database
npm audit --production