CVE-2026-59874: node-tar Infinite Loop Denial of Service

Technical summary

The vulnerability stems from improper validation of base-256 encoded entry sizes in tar headers. Tar archives use a specific format for file metadata, including size fields that can be encoded as base-256 numbers for large files. In affected versions of node-tar, the library fails to correctly validate negative values in these size fields. When tar.replace() encounters such a header, the scanner cannot determine a valid file boundary, causing it to loop indefinitely on the same header structure rather than progressing through the archive. This is classified as an infinite loop vulnerability (CWE-835) and results in a denial-of-service condition.

Business impact

Systems that automatically process tar archives—such as deployment pipelines, container image builders, package managers, or backup restoration tools—face availability risk. An attacker could supply a malicious tar file that, when processed by vulnerable node-tar versions, consumes CPU and blocks processing threads indefinitely. This could disrupt CI/CD workflows, prevent legitimate archive extraction, or cause service degradation in applications that handle user-uploaded tar files. Organizations relying on node-tar in production environments should treat this as a denial-of-service risk requiring prompt remediation.

Affected systems

The vulnerability affects node-tar (isaacs tar) versions prior to 7.5.18. Any application or service that directly or transitively depends on node-tar and processes tar archives—particularly untrusted or user-supplied archives—is at risk. This includes build tools, deployment systems, container platforms, and any Node.js application that extracts or manipulates tar files programmatically.

Exploitability

Exploitation requires no authentication or user interaction beyond providing a crafted tar archive to a vulnerable system. The attack surface is network-accessible if the application accepts remote tar file uploads or processes archives from untrusted sources. The barrier to exploitation is low: an attacker need only construct a tar header with a negative base-256 encoded size field, a straightforward task requiring knowledge of tar format structure but no sophisticated tooling. However, exploitation is limited to systems that actively process the malicious archive, making it a targeted denial-of-service vector rather than a widespread remote code execution risk.

Remediation

Upgrade node-tar to version 7.5.18 or later. Review your application's dependency tree to identify all direct and transitive uses of node-tar. Update package-lock.json or equivalent lock files and re-deploy. For applications unable to upgrade immediately, implement input validation upstream: reject tar archives with suspicious or malformed headers, or process archives in isolated environments with resource limits (CPU timeouts, thread pools) to prevent infinite loops from blocking critical services.

Patch guidance

Verify that your Node.js project's package.json permits node-tar 7.5.18 or higher, or update the version constraint accordingly. Run npm update or yarn upgrade to pull the patched version. If using a monorepo, ensure all workspaces and dependencies reference the fixed version. Test archive extraction with your application's typical workflows before deploying to production. If your project pins an older major version of node-tar, consult the upstream changelog to confirm compatibility before upgrading.

Detection guidance

Monitor for CPU spikes or hung processes associated with tar extraction operations. Log archive processing times; sustained extraction of a single archive with no data progress suggests the infinite loop condition. Implement application-level timeouts on archive operations and alert if extraction exceeds expected thresholds. Review tar files submitted by users for anomalous headers; tools like tar -tvf can preview headers and reveal suspicious size fields. In SIEM systems, flag processes spawning tar operations that consume CPU for extended periods without completing.

Why prioritize this

This vulnerability merits prompt patching because it combines low exploitation complexity with direct availability impact. While not a data breach vector, the denial-of-service mechanism is trivial to trigger and affects any system processing untrusted tar archives. Organizations with user-facing upload features or automated archive handling should prioritize this update. Severity is elevated (CVSS 7.5) because of the ease of exploitation and broad applicability of tar processing in modern development workflows.

Risk score, explained

CVSS 3.1 score of 7.5 (HIGH) reflects a network-accessible denial-of-service vulnerability with no authentication requirement and low attack complexity. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H indicates: network attack vector, low complexity, no privilege or user interaction required, and high availability impact. The score does not account for confidentiality or integrity compromise, as this is purely a resource exhaustion issue. Organizations should not underestimate this score; while not critical, HIGH-severity DoS vulnerabilities in widely-used libraries warrant immediate attention.

Frequently asked questions