{"id":"EUVD-2026-42308","enisaUuid":"0c124974-bc8e-3f02-b638-fa144411f388","description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPath(entry.path).split(\u0027/\u0027) to throw an uncaught TypeError. This issue is fixed in version 7.5.18.","datePublished":"Jul 8, 2026, 3:25:09 PM","dateUpdated":"Jul 8, 2026, 4:13:05 PM","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","references":"https://github.com/isaacs/node-tar/security/advisories/GHSA-w8wr-v893-vjvp\nhttps://github.com/isaacs/node-tar/commit/e02a4e9e013c4be95302e2eb2047a942b883c27b\nhttps://github.com/isaacs/node-tar/releases/tag/v7.5.18\n","aliases":"CVE-2026-59871\nGHSA-w8wr-v893-vjvp\n","assigner":"GitHub_M","epss":0.64,"enisaIdProduct":[{"id":"2899fba8-03ad-3772-b77c-2ffd7be7bdd5","product":{"name":"node-tar","vendor":{"name":"isaacs"}},"product_version":"\u003c 7.5.18"}],"enisaIdVendor":[{"id":"37faa6a1-94ac-3824-ad94-7a421f5840bb","vendor":{"name":"isaacs"}}],"enisaIdVulnerability":[{"id":"e956aee9-88f0-31a6-8d49-bcf126b99a3b","vulnerability":{"id":"CVE-2026-59871","description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPath(entry.path).split(\u0027/\u0027) to throw an uncaught TypeError. This issue is fixed in version 7.5.18.","datePublished":"Jul 8, 2026, 3:25:09 PM","dateUpdated":"Jul 8, 2026, 4:13:05 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","references":"https://github.com/isaacs/node-tar/security/advisories/GHSA-w8wr-v893-vjvp\nhttps://github.com/isaacs/node-tar/commit/e02a4e9e013c4be95302e2eb2047a942b883c27b\nhttps://github.com/isaacs/node-tar/releases/tag/v7.5.18\n","enisa_id":"EUVD-2026-42308\n","assigner":"GitHub_M","epss":0.64,"dataProcessed":"Oct 30, 2026, 7:17:41 AM","vulnerabilityProduct":[{"id":"3845a65f-033c-38f2-a021-cbf36cbfa089","product":{"name":"node-tar","vendor":{"name":"isaacs"}},"product_version":"\u003c 7.5.18"}],"vulnerabilityVendor":[{"id":"99090de0-c7aa-359d-b9c5-41b5730b7be9","vendor":{"name":"isaacs"}}]}},{"id":"f9ae0e66-474f-31c2-935b-2f126705df95","vulnerability":{"id":"GHSA-w8wr-v893-vjvp","description":"node-tar: Process crash via PAX numeric path type confusion","datePublished":"Jul 20, 2026, 9:53:14 PM","dateUpdated":"Jul 20, 2026, 9:53:14 PM","baseScore":0.0,"references":"https://github.com/isaacs/node-tar/security/advisories/GHSA-w8wr-v893-vjvp\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-59871\nhttps://github.com/isaacs/node-tar/commit/e02a4e9e013c4be95302e2eb2047a942b883c27b\nhttps://github.com/isaacs/node-tar\nhttps://github.com/isaacs/node-tar/releases/tag/v7.5.18\n","enisa_id":"EUVD-2026-42308\n","aliases":"CVE-2026-59871\nGHSA-w8wr-v893-vjvp\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:57:47 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"09c14361-44a2-331a-9dfd-d16ea6b0bebe","advisory":{"id":"NCSC-2026-0325","description":"Kwetsbaarheden verholpen in Atlassian producten","datePublished":"Aug 24, 2026, 9:52:27 AM","dateUpdated":"Aug 24, 2026, 9:52:27 AM","baseScore":0.0,"references":"","aliases":"CVE-2021-44906\nCVE-2022-3517\nCVE-2023-45133\nCVE-2025-14813\nCVE-2026-0603\nCVE-2026-2332\nCVE-2026-3505\nCVE-2026-4800\nCVE-2026-6321\nCVE-2026-6322\nCVE-2026-10050\nCVE-2026-12143\nCVE-2026-12151\nCVE-2026-12802\nCVE-2026-12803\nCVE-2026-12816\nCVE-2026-13149\nCVE-2026-13506\nCVE-2026-13676\nCVE-2026-14257\nCVE-2026-14682\nCVE-2026-16221\nCVE-2026-18446\nCVE-2026-21582\nCVE-2026-24734\nCVE-2026-25639\nCVE-2026-27601\nCVE-2026-27606\nCVE-2026-29786\nCVE-2026-40983\nCVE-2026-40984\nCVE-2026-41284\nCVE-2026-41842\nCVE-2026-41845\nCVE-2026-41850\nCVE-2026-41851\nCVE-2026-41907\nCVE-2026-42033\nCVE-2026-42035\nCVE-2026-42041\nCVE-2026-42198\nCVE-2026-42583\nCVE-2026-42587\nCVE-2026-43513\nCVE-2026-44249\nCVE-2026-44486\nCVE-2026-44487\nCVE-2026-44488\nCVE-2026-44490\nCVE-2026-44492\nCVE-2026-44494\nCVE-2026-44495\nCVE-2026-44496\nCVE-2026-45416\nCVE-2026-45623\nCVE-2026-46625\nCVE-2026-47838\nCVE-2026-48043\nCVE-2026-48779\nCVE-2026-48801\nCVE-2026-50010\nCVE-2026-53434\nCVE-2026-54291\nCVE-2026-54512\nCVE-2026-54513\nCVE-2026-55685\nCVE-2026-55831\nCVE-2026-55833\nCVE-2026-56745\nCVE-2026-56819\nCVE-2026-58059\nCVE-2026-58060\nCVE-2026-59639\nCVE-2026-59642\nCVE-2026-59869\nCVE-2026-59871\nCVE-2026-59873\nCVE-2026-59874\nCVE-2026-59887\nCVE-2026-59901\nCVE-2026-67320\nCVE-2026-69152\nCVE-2026-69192\n","source":{"id":19,"name":"csaf_ncscnl"},"advisoryProduct":[{"id":"170a1c52-adbb-320e-94d0-33a5711321dc","product":{"name":"Crowd Data Center","vendor":{"name":"Atlassian"}}},{"id":"18662808-19fc-3157-be9d-8fb300139a9e","product":{"name":"Jira Service Management Server","vendor":{"name":"Atlassian"}}},{"id":"3fe220b2-1702-3427-b7c7-0618c88544dd","product":{"name":"Jira Software Server","vendor":{"name":"Atlassian"}}},{"id":"44c9344f-7325-3ea1-9012-f39b5146ceb0","product":{"name":"Crucible","vendor":{"name":"Atlassian"}}},{"id":"481ac1a3-3c02-3f54-beba-841a141ee4fb","product":{"name":"Bitbucket Data Center","vendor":{"name":"Atlassian"}}},{"id":"55a57635-13c9-3c78-8b2a-a55986202aa5","product":{"name":"Fisheye","vendor":{"name":"Atlassian"}}},{"id":"6c6d82b5-99a7-3d82-8488-58e579615289","product":{"name":"Confluence Data Center","vendor":{"name":"Atlassian"}}},{"id":"71699538-d32c-3e3d-9180-7d0859671cc0","product":{"name":"Jira Software Data Center","vendor":{"name":"Atlassian"}}},{"id":"7da001d6-1116-328e-8e2a-d61b986c6666","product":{"name":"Jira Service Management Data Center","vendor":{"name":"Atlassian"}}},{"id":"8e530a72-7406-32f1-8d15-db28465ff434","product":{"name":"Jira","vendor":{"name":"Atlassian"}}},{"id":"b2bffff3-a72d-3483-ab52-252985a565e0","product":{"name":"Bamboo","vendor":{"name":"Atlassian"}}},{"id":"de56514e-8f60-312d-9135-a5d49ab9b032","product":{"name":"Confluence","vendor":{"name":"Atlassian"}}},{"id":"fc875e65-ceaf-38bf-b4b7-3436ad75ec9f","product":{"name":"bitbucket","vendor":{"name":"Atlassian"}}}]}},{"id":"31cb92be-32c0-3e7e-b4ec-24f6cdd0fc41","advisory":{"id":"WID-SEC-W-2026-2923","description":"Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye, und Jira): Mehrere Schwachstellen","summary":"Ein Angreifer kann mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence, Atlassian Crucible, Atlassian Fisheye und Atlassian Jira ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen, um einen SQL-Injection Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen.","datePublished":"Aug 18, 2026, 10:00:00 PM","dateUpdated":"Aug 31, 2026, 10:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2923.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2026-2923\n","aliases":"CVE-2019-13990\nCVE-2021-44906\nCVE-2022-1471\nCVE-2022-23521\nCVE-2022-3517\nCVE-2022-41903\nCVE-2023-22518\nCVE-2023-22522\nCVE-2023-22523\nCVE-2023-22524\nCVE-2023-22527\nCVE-2023-45133\nCVE-2023-46604\nCVE-2025-14813\nCVE-2026-0603\nCVE-2026-10050\nCVE-2026-12143\nCVE-2026-12151\nCVE-2026-12802\nCVE-2026-12803\nCVE-2026-12816\nCVE-2026-13149\nCVE-2026-13506\nCVE-2026-13676\nCVE-2026-14257\nCVE-2026-14682\nCVE-2026-16221\nCVE-2026-18446\nCVE-2026-21582\nCVE-2026-2332\nCVE-2026-24734\nCVE-2026-25639\nCVE-2026-27601\nCVE-2026-27606\nCVE-2026-29786\nCVE-2026-3505\nCVE-2026-40983\nCVE-2026-40984\nCVE-2026-41284\nCVE-2026-41842\nCVE-2026-41845\nCVE-2026-41850\nCVE-2026-41851\nCVE-2026-41907\nCVE-2026-42033\nCVE-2026-42035\nCVE-2026-42041\nCVE-2026-42198\nCVE-2026-42583\nCVE-2026-42587\nCVE-2026-43513\nCVE-2026-44249\nCVE-2026-44486\nCVE-2026-44487\nCVE-2026-44488\nCVE-2026-44490\nCVE-2026-44492\nCVE-2026-44494\nCVE-2026-44495\nCVE-2026-44496\nCVE-2026-45416\nCVE-2026-45623\nCVE-2026-46625\nCVE-2026-47838\nCVE-2026-4800\nCVE-2026-48043\nCVE-2026-48779\nCVE-2026-48801\nCVE-2026-50010\nCVE-2026-53434\nCVE-2026-54291\nCVE-2026-54512\nCVE-2026-54513\nCVE-2026-55685\nCVE-2026-55831\nCVE-2026-55833\nCVE-2026-56745\nCVE-2026-56819\nCVE-2026-58059\nCVE-2026-58060\nCVE-2026-59639\nCVE-2026-59642\nCVE-2026-59869\nCVE-2026-59871\nCVE-2026-59873\nCVE-2026-59874\nCVE-2026-59887\nCVE-2026-59901\nCVE-2026-6321\nCVE-2026-6322\nCVE-2026-67320\nCVE-2026-69152\nCVE-2026-69192\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"0e1af4e3-8203-30f2-a3c5-a1140e14f285","product":{"name":"Data Center LTS 12.1.10","vendor":{"name":"Atlassian"}}},{"id":"14600e0c-6f54-3776-8acd-cc4015a694e1","product":{"name":"5.36.00.16","vendor":{"name":"Dell"}}},{"id":"16a307c3-d9c6-3128-9db7-1d9d3442b475","product":{"name":"Data Center LTS 11.3.10","vendor":{"name":"Atlassian"}}},{"id":"2ad7df62-5885-3d31-83f0-76e009af21f6","product":{"name":"Bamboo","vendor":{"name":"Atlassian"}}},{"id":"31c9277b-40c2-327d-8d49-a225155d8670","product":{"name":"Red Hat Enterprise Linux","vendor":{"name":"Red Hat"}}},{"id":"4d970977-d6c9-3b09-bc57-ca233725535f","product":{"name":"bitbucket","vendor":{"name":"Atlassian"}}},{"id":"541cd1b3-bc5e-30d3-8c55-ad40111f8d73","product":{"name":"Crucible","vendor":{"name":"Atlassian"}}},{"id":"54571747-b4b3-31e1-9143-fc1fe6467271","product":{"name":"Data Center LTS 10.2.15","vendor":{"name":"Atlassian"}}},{"id":"69d7a7fe-c469-3675-810f-38ec07e5ab58","product":{"name":"Jira","vendor":{"name":"Atlassian"}}},{"id":"79c54bee-9530-3dae-87c5-110b48859609","product":{"name":"Data Center LTS 10.2.6","vendor":{"name":"Atlassian"}}},{"id":"79f0c203-76cf-3408-b0f3-faa91378410b","product":{"name":"Secure Connect Gateway","vendor":{"name":"Dell"}}},{"id":"7b55333a-a375-3786-8ec2-03d4cc538471","product":{"name":"Data Center LTS 10.3.24","vendor":{"name":"Atlassian"}}},{"id":"b2265e03-4041-34ab-95ea-ddf0ff37561f","product":{"name":"Data Center LTS 9.4.23","vendor":{"name":"Atlassian"}}},{"id":"bbe6b862-a6cc-31ed-bba8-98521886eeaa","product":{"name":"Confluence","vendor":{"name":"Atlassian"}}},{"id":"c80adcd3-cae2-314d-b796-9841c69e4650","product":{"name":"Fisheye","vendor":{"name":"Atlassian"}}},{"id":"cad82322-0fb9-33fd-ab74-b496b8b1c797","product":{"name":"4.9.13","vendor":{"name":"Atlassian"}}},{"id":"cb873063-ab2c-371c-810d-a1c70f301c6c","product":{"name":"Data Center 10.4.2","vendor":{"name":"Atlassian"}}},{"id":"d558b485-b038-3397-b430-36b0fe2327bb","product":{"name":"Data Center LTS 10.2.22","vendor":{"name":"Atlassian"}}},{"id":"dcc3ee03-9d7b-3370-8c0b-413098535d3e","product":{"name":"Data Center LTS 9.2.23","vendor":{"name":"Atlassian"}}}]}},{"id":"e1eb8f7d-6913-3acb-adb5-d30635df31ff","advisory":{"id":"msrc_CVE-2026-59871","description":"node-tar: Process crash via PAX numeric path type confusion","datePublished":"Jul 12, 2026, 1:01:34 AM","dateUpdated":"Aug 13, 2026, 12:11:13 AM","baseScore":0.0,"references":"https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-59871.json\n","aliases":"CVE-2026-59871\n","source":{"id":20,"name":"csaf_microsoft"},"advisoryProduct":[{"id":"7e582856-9ec5-33d7-92ce-58379b0c212a","product":{"name":"3.0","vendor":{"name":"Wind River"}}},{"id":"e8ff6ac6-b8e3-3346-8954-73119373090f","product":{"name":"Azure Linux","vendor":{"name":"Microsoft"}}},{"id":"f008d40e-2c07-3790-bf8e-672cf354fd3b","product":{"name":"azl3 tar 0:1.35-2.azl3","vendor":{"name":"Microsoft"}}}]}}]}