{"id":"EUVD-2026-42303","revision":"35759882499c44cdb843b9efd0020feb","records":[{"revision":"35759882499c44cdb843b9efd0020feb","observedAt":"2026-11-01T11:24:45.355+00:00","statement":{"source":"euvd","id":"EUVD-2026-42303","aliases":["CVE-2026-59875","GHSA-gvwx-54wh-qm9j"],"title":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.lstat or fs.open and termina…","description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.lstat or fs.open and terminate the process with an uncaught exception. This issue is fixed in version 7.5.17.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3,"severity":null}],"references":["https://github.com/isaacs/node-tar/security/advisories/GHSA-gvwx-54wh-qm9j","https://github.com/isaacs/node-tar/commit/7a635c29f5edbf083557374d43984273ecfed5b3","https://github.com/isaacs/node-tar/releases/tag/v7.5.17"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42303","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jul 8, 2026, 3:20:29 PM","dateUpdated":"Jul 9, 2026, 1:45:44 PM"},"relatedAdvisories":[{"id":"msrc_CVE-2026-59875","title":"node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records","vulnerabilityIds":["CVE-2026-59875"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-42303","identifiers":["EUVD-2026-42303","CVE-2026-59875","GHSA-gvwx-54wh-qm9j"]},"retained":false,"historicalAffected":[]}],"coverage":[]}