Node.js Tar Library Vulnerability Impacting Node-Tar

CVE-2026-59875

What is CVE-2026-59875?

The node-tar library, utilized for tar archive manipulations in Node.js, contains a flaw where NUL bytes are not stripped from PAX path and linkpath records. This vulnerability enables an attacker to craft a malicious archive that can exploit the way the library interacts with file system functions. As a result, attempts to process such an archive may lead to execution failures, culminating in uncaught exceptions during the file operations. The vulnerability has been addressed in version 7.5.17, and it is recommended that users update their installations to this release to mitigate potential risks.

References