CVE-2026-59875: node-tar DOS Vulnerability

CVE-2026-59875 Overview

CVE-2026-59875 affects node-tar, a widely used tar archive manipulation library for Node.js. Versions prior to 7.5.17 fail to strip NUL bytes from PAX path and linkpath records in src/pax.ts. A crafted archive can pass values containing embedded NUL bytes to fs.lstat or fs.open, causing the Node.js process to terminate with an uncaught exception. The issue is a denial-of-service condition affecting availability only, with no impact on confidentiality or integrity. Version 7.5.17 fixes the flaw by truncating PAX string values at the first NUL byte. The vulnerability is tracked under [CWE-248: Uncaught Exception].

Critical Impact
A remote attacker supplying a malicious tar archive can crash any Node.js process that parses it using node-tar, disrupting build pipelines, package installers, and archive extraction services.

Affected Products

node-tar versions prior to 7.5.17
Node.js applications and tooling depending on vulnerable node-tar releases
Package managers and build systems that use node-tar to extract untrusted archives

Discovery Timeline

2026-07-08 - CVE-2026-59875 published to NVD
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-59875

Vulnerability Analysis

The flaw lives in src/pax.ts, the module responsible for parsing PAX extended header records inside tar archives. PAX records use key=value pairs to hold metadata such as long paths and link targets. The parser accepts the raw value without normalizing embedded NUL characters. When these values are later handed to Node.js file system calls like fs.lstat or fs.open, the C-level path handling rejects strings containing NUL bytes and throws a TypeError. Because the throw occurs on an asynchronous path outside application-level try/catch scope, the exception bubbles up and terminates the Node.js process.

Root Cause

The root cause is missing input sanitization in the PAX record parser. The upstream code joined the value portion of a PAX record with kv.join('=') and stored it directly. C-style strings terminate at the first NUL, but JavaScript strings do not, so any NUL byte and everything following it were retained. Downstream file system APIs then rejected the malformed path, and no handler existed to catch the resulting exception.

Attack Vector

An attacker crafts a tar archive containing a PAX header with a path or linkpath record whose value includes a NUL byte. When a victim application extracts or lists the archive using vulnerable node-tar, the parser produces a path string containing the embedded NUL. The subsequent fs.lstat or fs.open call throws, killing the process. The attack requires no authentication or user interaction beyond triggering archive processing.

typescript

// Patch from src/pax.ts - terminate pax strings on nul bytes
  const k = r.replace(/^SCHILY\.(dev|ino|nlink)/, '$1')

-  const v = kv.join('=')
+  const v = kv.join('=').replace(/\0.*/, '')
  set[k] =
    /^([A-Z]+\.)?([mac]|birth|creation)time$/.test(k) ?
      new Date(Number(v) * 1000)
// Source: https://github.com/isaacs/node-tar/commit/7a635c29f5edbf083557374d43984273ecfed5b3

Detection Methods for CVE-2026-59875

Indicators of Compromise

Unexpected Node.js process termination with an uncaught TypeError referencing NUL byte arguments to fs.lstat, fs.open, or path handling functions.
Repeated crashes of archive-processing services shortly after ingesting user-supplied .tar, .tar.gz, or .tgz files.
Presence of tar archives containing PAX headers where path or linkpath values include \\x00 bytes.

Detection Strategies

Inventory Node.js projects and CI/CD tooling for direct or transitive dependencies on node-tar below 7.5.17 using npm ls tar or software composition analysis tools.
Scan tar archives at ingress for PAX extended headers containing embedded NUL bytes in path fields before extraction.
Monitor application logs for stack traces mentioning pax.ts, parse.js, or NUL-byte path errors emitted from fs operations.

Monitoring Recommendations

Alert on abnormal restart counts of services that process uploaded archives, container images, or npm tarballs.
Track dependency updates and pin node-tar to 7.5.17 or later across all Node.js workloads.
Correlate archive upload events with process crash telemetry from endpoint and workload sensors to identify targeted denial-of-service attempts.

How to Mitigate CVE-2026-59875

Immediate Actions Required

Upgrade node-tar to version 7.5.17 or later in all applications, build agents, and container images.
Rebuild and redeploy any published Node.js packages or Docker images that bundle a vulnerable node-tar.
Audit transitive dependencies with npm audit or npm ls tar and force resolution to the patched version where nested versions remain vulnerable.

Patch Information

The fix is available in node-tar 7.5.17. The patch, committed in 7a635c2, truncates PAX record values at the first NUL byte using .replace(/\0.*/, ''). Full details are documented in GitHub Security Advisory GHSA-gvwx-54wh-qm9j and the v7.5.17 release notes.

Workarounds

Reject or pre-validate untrusted tar archives before passing them to node-tar, filtering out entries whose PAX headers contain NUL bytes in path fields.
Wrap archive extraction in an isolated worker process or child process so an uncaught exception does not crash the primary service.
Restrict archive ingestion to authenticated sources and enforce size and content-type constraints at the network edge.

bash

# Upgrade node-tar to the patched release
npm install tar@^7.5.17

# Verify the installed version across the dependency tree
npm ls tar

# Force resolution for nested vulnerable copies (npm 8.3+)
npm install --save-exact tar@7.5.17