node-tar: Process crash via PAX numeric path type confusion

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-59871 · Microsoft / collected KEV context

EUVD-2026-42308

GHSA-w8wr-v893-vjvp

cve-program · CVE-2026-59871

• https://github.com/isaacs/node-tar/security/advisories/GHSA-w8wr-v893-vjvp
• https://github.com/isaacs/node-tar/commit/e02a4e9e013c4be95302e2eb2047a942b883c27b
• https://github.com/isaacs/node-tar/releases/tag/v7.5.18

euvd · EUVD-2026-42308

• https://github.com/isaacs/node-tar/security/advisories/GHSA-w8wr-v893-vjvp
• https://github.com/isaacs/node-tar/commit/e02a4e9e013c4be95302e2eb2047a942b883c27b
• https://github.com/isaacs/node-tar/releases/tag/v7.5.18

nvd · CVE-2026-59871

• https://github.com/isaacs/node-tar/commit/e02a4e9e013c4be95302e2eb2047a942b883c27b
• https://github.com/isaacs/node-tar/releases/tag/v7.5.18
• https://github.com/isaacs/node-tar/security/advisories/GHSA-w8wr-v893-vjvp

osv · GHSA-w8wr-v893-vjvp

• https://github.com/isaacs/node-tar/security/advisories/GHSA-w8wr-v893-vjvp
• https://nvd.nist.gov/vuln/detail/CVE-2026-59871
• https://github.com/isaacs/node-tar/commit/e02a4e9e013c4be95302e2eb2047a942b883c27b
• https://github.com/isaacs/node-tar
• https://github.com/isaacs/node-tar/releases/tag/v7.5.18

No related operational record is retained in the current change model.