CVE-2026-59875

What it actually does

The flaw is an availability issue in node-tar versions prior to 7.5.17. When processing PAX extended headers, the library fails to remove NUL bytes from the path and linkpath fields. A crafted tar archive can cause those malformed values to be passed into Node.js filesystem APIs such as fs.lstat or fs.open. Node.js rejects paths containing NUL bytes and throws an exception; if the application does not catch that exception, the process can terminate. The impact is denial of service, not direct code execution, privilege escalation, data theft, or archive path traversal.

Why it matters to the business

Applications or services that accept or process untrusted tar archives can be crashed remotely by a malformed archive, causing temporary service interruption, failed package/import jobs, worker restarts, degraded batch processing, or denial of service for users relying on archive upload/extraction workflows. The current public exploitation signal is low: EPSS is 0.00292, there is no known CISA KEV listing, no ransomware association, and no mature public exploit is indicated; however, remediation is still recommended because the fix is straightforward and archive parsing bugs are often reachable through file upload, CI/CD, dependency ingestion, artifact scanning, backup, and package management workflows.

How an attack unfolds

An attacker identifies an application, API, job worker, or automation pipeline that uses vulnerable node-tar code to inspect or extract tar archives supplied by users or external systems. The attacker creates a tar file with PAX path or linkpath metadata containing embedded NUL bytes. When the target processes the archive, node-tar passes the malformed path value into Node.js filesystem functions such as fs.lstat or fs.open. Those functions throw an invalid path exception because paths cannot contain NUL bytes. If the application has not wrapped archive processing in defensive exception handling, the exception is uncaught and the Node.js process exits or the worker crashes. The attacker can repeat submissions to create recurring availability impact until the dependency is upgraded or archive processing is isolated and hardened.

How to fix it

Upgrade node-tar to version 7.5.17 or later wherever it is used directly or transitively. For npm-based projects, update the tar package and regenerate lockfiles as appropriate, then redeploy rebuilt artifacts and containers. Use dependency tooling such as npm ls tar, npm audit, npm explain tar, yarn why tar, pnpm why tar, or software composition analysis to identify transitive use. If an immediate upgrade is not possible, reduce exposure by rejecting untrusted tar archives, enforcing strict upload size and type controls, processing archives in isolated worker processes or sandboxes, adding robust try/catch handling around archive parsing and extraction, rate-limiting archive-processing endpoints, and ensuring process supervisors restart failed workers without creating restart storms. These mitigations reduce impact but do not replace upgrading to the fixed version.

How to confirm the fix worked

Confirm that all runtime artifacts, containers, and deployed builds resolve node-tar/tar to version 7.5.17 or later. Validate lockfiles and installed dependency trees, not only package.json version ranges. Run npm ls tar or the equivalent package-manager command in each application build context and confirm no vulnerable version remains. Review container images and serverless bundles for embedded node_modules/tar versions older than 7.5.17. Where safe, perform a controlled negative test in a non-production environment using a malformed tar archive with NUL bytes in PAX path/linkpath metadata and confirm the application rejects or handles the archive without an uncaught exception or process termination. Also confirm archive-processing errors are logged and converted into controlled failure responses rather than crashing the service.

Typical attack path

1. Locate an application endpoint, queue consumer, build system, artifact processor, or backend job that accepts or retrieves tar archives from untrusted sources.
2. Craft a tar archive containing PAX extended header path or linkpath records with embedded NUL bytes.
3. Submit, upload, publish, or otherwise cause the target service to process the crafted archive.
4. Trigger node-tar parsing so the malformed PAX value reaches filesystem operations such as fs.lstat or fs.open.
5. Cause Node.js to throw an invalid path exception due to the NUL byte in the path value.
6. Rely on missing exception handling to terminate the process, crash a worker, or force repeated service restarts.

How to detect it

To determine whether exploitation has already occurred, review application logs, Node.js runtime logs, process supervisor logs, container orchestration events, crash reports, and API/upload audit logs for archive-processing failures followed by process exits or restarts. Focus on timestamps where tar uploads, artifact ingestion, package imports, backup restores, CI jobs, or extraction tasks coincide with TypeError or ERR_INVALID_ARG_VALUE exceptions mentioning paths with null bytes. Check process managers such as systemd, PM2, Docker, Kubernetes, ECS, Nomad, or serverless runtime logs for repeated restarts of Node.js workers after archive handling. Review web/API access logs for repeated archive upload attempts, unusual tar file submissions, high failure rates on archive-processing endpoints, or repeated requests from the same source immediately preceding crashes. In forensic review, inspect retained uploaded archives or queued artifacts for PAX extended headers containing path or linkpath values with embedded NUL bytes. Because this vulnerability produces a denial-of-service condition rather than a persistent compromise, evidence is most likely to appear as exception traces, crash loops, failed jobs, and malformed archive submissions rather than files written to disk or new processes spawned by the attacker.

• ERR_INVALID_ARG_VALUE
• without null bytes
• without NUL bytes
• The argument 'path' must be a string, Uint8Array, or URL without null bytes
• TypeError [ERR_INVALID_ARG_VALUE]
• fs.lstat
• fs.open
• PAX path
• PAX linkpath
• path contains null bytes
• node_modules/tar
• node_modules/tar/dist
• node_modules/tar/src/pax.ts
• uncaughtException
• UnhandledPromiseRejection
• PM2 process exited
• CrashLoopBackOff

What your security team should do

• Inventory Node.js services, CI/CD jobs, artifact processors, package ingestion systems, upload handlers, and backend workers that process tar archives.
• Prioritize patching externally reachable or unauthenticated archive-processing paths first, even though current exploitation probability is low.
• Upgrade node-tar/tar to 7.5.17 or later and ensure lockfiles, container images, and deployed bundles are rebuilt from the patched dependency tree.
• Add defensive exception handling and input validation around archive parsing so malformed archives cannot terminate the parent service process.
• Process untrusted archives in isolated workers, sandboxes, or short-lived subprocesses with resource limits to contain future parser failures.
• Add monitoring for Node.js process crashes, worker restarts, and invalid path exceptions correlated with archive upload or extraction activity.
• Review recent logs for signs of repeated malformed archive submissions or crashes containing NUL-byte path validation errors.
• Apply rate limits and abuse controls to endpoints or queues that trigger archive extraction or inspection.
• If archive processing is not business-critical, temporarily disable untrusted tar ingestion until patching is complete.