CVE-2026-59871

What it actually does

CVE-2026-59871 is a denial-of-service flaw in the Node.js node-tar package before version 7.5.18. When parsing PAX extended headers, all-digit path or linkpath values are coerced into JavaScript numbers instead of remaining strings. Later path-processing logic expects string values, such as during Windows path normalization and path splitting, and can throw an uncaught TypeError. If an application processes attacker-supplied tar archives without isolating or catching this failure, the process handling the archive can crash or terminate the request workflow.

Why it matters to the business

Applications that accept or process tar archives from users, automated feeds, package registries, CI/CD workflows, backup systems, or integration pipelines may be vulnerable to service disruption. The likely impact is availability loss rather than data theft or data modification: a crafted archive can cause archive extraction or inspection to fail and may crash a Node.js service if errors are not handled safely. Because exploit code is reportedly available and the attack requires no authentication or user interaction when tar files are accepted over a network-facing workflow, exposed archive-processing services should be prioritized even though the CVSS and EPSS indicate moderate-to-low broad exploitation likelihood.

How an attack unfolds

An attacker creates a tar archive containing PAX extended metadata where the path or linkpath value is composed only of digits. In vulnerable node-tar versions, that value is coerced into a JavaScript number during parsing. The attacker then submits the archive to an application feature that extracts, lists, scans, imports, uploads, or otherwise processes tar files using node-tar. When node-tar or downstream code attempts path normalization and string operations on the numeric value, an uncaught TypeError can occur. Depending on how the consuming application is built, this may abort the archive operation, crash a worker, terminate a Node.js process, or cause repeated failures if the malicious archive is retried by a queue or automation pipeline.

How to fix it

Upgrade node-tar to version 7.5.18 or later wherever it is used directly or transitively. Review package lockfiles to ensure the resolved tar package version is fixed, not only the top-level dependency declaration. Rebuild and redeploy affected Node.js applications after dependency updates. If immediate upgrade is not possible, mitigate by rejecting untrusted tar archives, disabling archive upload/import features, processing archives in isolated worker processes or sandboxes, enforcing file size and entry count limits, and wrapping archive parsing in robust exception handling so malformed input cannot crash the main service. Also ensure queue-based processing does not endlessly retry the same malformed archive without quarantine or dead-letter handling.

How to confirm the fix worked

Confirm that dependency manifests and lockfiles resolve node-tar/tar to version 7.5.18 or later. Use package inventory tools such as npm ls tar, npm audit, SCA tooling, or SBOM comparison to identify vulnerable transitive dependencies. Run regression tests against archive upload, extraction, import, and CI/CD workflows using malformed PAX archives to verify that errors are handled gracefully and do not terminate the process. In production-like environments, confirm that Node.js process managers, containers, and worker queues remain stable when malformed archives are rejected. Verify that vulnerable versions are absent from built artifacts, container images, serverless bundles, and vendored node_modules directories.

Typical attack path

1. Identify an application, API, CI/CD job, package-processing service, or backend workflow that accepts tar archives or compressed tar files.
2. Craft a tar archive with PAX extended headers containing all-digit path or linkpath values.
3. Submit or place the crafted archive where the vulnerable application will process it.
4. Trigger archive parsing, extraction, inspection, or import through the affected node-tar library.
5. Cause a TypeError during downstream path handling, potentially interrupting the request, crashing a worker, or disrupting service availability.
6. Repeat submissions or rely on automated retries to sustain disruption if rate limits, input validation, or process supervision are weak.

How to detect it

Review application logs, Node.js runtime logs, process manager logs, container logs, API gateway logs, upload service logs, worker queue logs, and CI/CD job logs for archive-processing failures followed by process exits, worker restarts, crash loops, or spikes in 5xx responses. Focus on endpoints or jobs that handle tar, tgz, package, backup, import, or artifact files. Look for uncaught TypeError stack traces involving tar PAX header parsing, path normalization, or split operations on non-string values. Correlate errors with recent file uploads or package ingestion events, especially repeated failures from the same source IP, account, artifact name, job, or queue message. Examine suspicious archives in a safe offline environment for PAX extended headers whose path or linkpath values are all digits. Because this issue primarily causes denial of service, evidence of exploitation is likely to appear as crash/restart patterns and malformed archive submissions rather than persistent files, new accounts, or command execution artifacts.

• TypeError
• Uncaught TypeError
• normalizeWindowsPath
• entry.path
• split is not a function
• path.split is not a function
• linkpath
• PAX
• pax.ts
• .tar
• .tgz
• .tar.gz
• npm ERR
• node:internal/process
• UnhandledPromiseRejection
• uncaughtException
• CrashLoopBackOff

What your security team should do

• Inventory all applications, build systems, automation jobs, and services that process tar, .tar.gz, .tgz, or package archives using Node.js dependencies.
• Upgrade node-tar/tar to 7.5.18 or later and redeploy affected applications, paying close attention to transitive dependency resolution in lockfiles and container images.
• Prioritize externally reachable archive upload/import endpoints, package ingestion services, and CI/CD systems that process untrusted archives.
• Add defensive controls for archive processing: strict input validation, size and entry limits, sandboxed extraction, exception handling, and quarantine of malformed archives.
• Search logs for TypeError crashes or repeated archive-processing failures since publication, especially around upload, import, package-processing, and extraction endpoints.
• Ensure worker queues and job runners dead-letter repeated failures instead of continuously retrying the same archive.
• Add monitoring for sudden increases in Node.js process restarts, 5xx responses, failed archive jobs, and container crash loops related to archive processing.