{"id":"EUVD-2026-42303","enisaUuid":"e2046ef8-db92-3a9c-b398-5df550e2a5a7","description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.lstat or fs.open and terminate the process with an uncaught exception. This issue is fixed in version 7.5.17.","datePublished":"Jul 8, 2026, 3:20:29 PM","dateUpdated":"Jul 9, 2026, 1:45:44 PM","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","references":"https://github.com/isaacs/node-tar/security/advisories/GHSA-gvwx-54wh-qm9j\nhttps://github.com/isaacs/node-tar/commit/7a635c29f5edbf083557374d43984273ecfed5b3\nhttps://github.com/isaacs/node-tar/releases/tag/v7.5.17\n","aliases":"CVE-2026-59875\nGHSA-gvwx-54wh-qm9j\n","assigner":"GitHub_M","epss":0.35,"enisaIdProduct":[{"id":"5fea4798-47c8-3dd0-a4c8-afb594d202e2","product":{"name":"node-tar","vendor":{"name":"isaacs"}},"product_version":"\u003c 7.5.17"}],"enisaIdVendor":[{"id":"34488382-b4e9-3586-ad24-26f01ac5a455","vendor":{"name":"isaacs"}}],"enisaIdVulnerability":[{"id":"72a053a3-e91b-3645-a404-9a8c8d44e946","vulnerability":{"id":"CVE-2026-59875","description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.lstat or fs.open and terminate the process with an uncaught exception. This issue is fixed in version 7.5.17.","datePublished":"Jul 8, 2026, 3:20:29 PM","dateUpdated":"Jul 9, 2026, 1:45:44 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","references":"https://github.com/isaacs/node-tar/security/advisories/GHSA-gvwx-54wh-qm9j\nhttps://github.com/isaacs/node-tar/commit/7a635c29f5edbf083557374d43984273ecfed5b3\nhttps://github.com/isaacs/node-tar/releases/tag/v7.5.17\n","enisa_id":"EUVD-2026-42303\n","assigner":"GitHub_M","epss":0.35,"dataProcessed":"Nov 1, 2026, 7:18:17 AM","vulnerabilityProduct":[{"id":"842d2267-0cd5-3361-8ca3-a79a950af968","product":{"name":"node-tar","vendor":{"name":"isaacs"}},"product_version":"\u003c 7.5.17"}],"vulnerabilityVendor":[{"id":"d0d259bd-a07f-3dbd-afa9-a8158a73aa5e","vendor":{"name":"isaacs"}}]}},{"id":"df1ec7b4-cc2c-31df-8c7d-1a32d23408b6","vulnerability":{"id":"GHSA-gvwx-54wh-qm9j","description":"node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records","datePublished":"Jul 20, 2026, 9:51:12 PM","dateUpdated":"Jul 20, 2026, 9:51:12 PM","baseScore":0.0,"references":"https://github.com/isaacs/node-tar/security/advisories/GHSA-gvwx-54wh-qm9j\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-59875\nhttps://github.com/isaacs/node-tar/commit/7a635c29f5edbf083557374d43984273ecfed5b3\nhttps://github.com/isaacs/node-tar\nhttps://github.com/isaacs/node-tar/releases/tag/v7.5.17\n","enisa_id":"EUVD-2026-42303\n","aliases":"GHSA-gvwx-54wh-qm9j\nCVE-2026-59875\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:02:28 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"d88c5a95-abdb-3d85-a118-f8111539e92b","advisory":{"id":"msrc_CVE-2026-59875","description":"node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records","datePublished":"Jul 15, 2026, 1:01:52 AM","dateUpdated":"Aug 13, 2026, 12:12:28 AM","baseScore":0.0,"references":"https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-59875.json\n","aliases":"CVE-2026-59875\n","source":{"id":20,"name":"csaf_microsoft"},"advisoryProduct":[{"id":"01715fb6-3f46-3707-9e9f-f635c9905f2f","product":{"name":"Azure Linux","vendor":{"name":"Microsoft"}}},{"id":"05ad06f1-a8f1-3920-942a-e14b1099863b","product":{"name":"azl3 tar 0:1.35-2.azl3","vendor":{"name":"Microsoft"}}},{"id":"635bfb27-f7b7-3dd4-b9d2-64cc3314adc6","product":{"name":"3.0","vendor":{"name":"Wind River"}}}]}}]}