CVE-2026-59871: node-tar Type Coercion DoS Vulnerability

Technical summary

CVE-2026-59871 stems from improper type coercion in node-tar's PAX header parsing logic (src/pax.ts). PAX (POSIX.1-2001 eXtended) headers in tar archives can contain metadata including path and linkpath fields. The vulnerable code converts all-digit values in these fields to JavaScript numbers, violating the expectation that entry.path remain a string. When normalizeWindowsPath() or similar path-handling functions attempt operations like .split('/') on a numeric value, a TypeError is thrown. This represents a Denial of Service vector where a maliciously crafted or accidentally malformed tar archive can crash any application using node-tar to extract its contents.

Business impact

Applications relying on node-tar for archive extraction—including build tools, package managers, deployment pipelines, and file-sharing services—face availability risk. A specially crafted tar file could trigger an unhandled exception, terminating the process and disrupting operations. Organizations heavily invested in Node.js-based infrastructure, CI/CD workflows, and containerized deployments may experience service interruptions. The impact is particularly acute in automated scenarios where tar extraction happens without human oversight or fallback mechanisms.

Affected systems

node-tar versions prior to 7.5.18 are vulnerable. The isaacs/tar package on npm is the primary distribution vector. Any Node.js application with a direct or transitive dependency on an affected node-tar version is at risk, particularly those processing untrusted or third-party tar archives. This includes npm itself and tools built on the Node.js ecosystem.

Exploitability

Exploitation requires only the ability to supply a tar archive to an application using vulnerable node-tar. No authentication or special privileges are needed; the attack is network-adjacent. An attacker could host a malicious tarball or inject one into a supply chain. However, weaponization requires awareness that a target uses node-tar and processing of untrusted archives—not a trivial precondition in all environments. The CVSS score of 5.3 reflects moderate exploitability with limited attack surface in some deployment models.

Remediation

Upgrade node-tar to version 7.5.18 or later. This is a straightforward patching scenario; verify the fix in the vendor advisory and update package.json and lock files accordingly. No workarounds are documented, making prompt patching the only remediation path. Organizations should prioritize this update in applications that extract archives from external sources or untrusted users.

Patch guidance

Update node-tar dependency to 7.5.18 or newer using npm update or manual version bump in package.json. Regenerate lock files (package-lock.json or yarn.lock) and redeploy affected services. For applications with pinned dependencies or monorepos, ensure all consuming packages are updated in sync. Test archive extraction workflows after patching to confirm normal operation. Verify the upgrade using npm list node-tar to confirm the installed version.

Detection guidance

Monitor logs for uncaught TypeErrors mentioning 'split' or path normalization during tar extraction. Review dependency trees for node-tar versions < 7.5.18 using npm ls or similar tools. Set up automated scanning in CI/CD pipelines (e.g., npm audit, Snyk) to flag vulnerable versions. Honeypot tar files with all-digit path entries can trigger the vulnerability in test environments to confirm exposure. Network-based detection is difficult without deep packet inspection into archive contents.

Why prioritize this

While the CVSS score is moderate (5.3), the ease of exploitation and widespread use of node-tar in the Node.js ecosystem warrant prompt attention. Outages are costly; however, this is not a data breach or privilege escalation risk. Prioritize based on whether your applications ingest untrusted archives and their operational criticality. Development and CI/CD systems handling third-party packages should be patched urgently; internal tools with controlled inputs can follow standard maintenance windows.

Risk score, explained

The CVSS 3.1 score of 5.3 (MEDIUM severity) reflects a network-accessible Denial of Service with low attack complexity and no user interaction required. The vector AV:N/AC:L/PR:N/UI:N indicates an unauthenticated attacker can trigger the flaw over the network. However, confidentiality and integrity are not impacted (C:N/I:N), and availability impact is localized (A:L), capping the score. The flaw is real and easily triggered but narrower in scope than critical code execution or data exfiltration vulnerabilities.

Frequently asked questions