ByteOS Network

NVD Vulnerability Details :

CVE-2026-59874

Undergoing Analysis

Source-security-advisories@github.com

Published At-08 Jul, 2026 | 16:16

Updated At-10 Jul, 2026 | 18:01

node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	4.0	8.7	HIGH	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
			N/A

Type: Secondary

Version: 4.0

Base score: 8.7

Base severity: HIGH

Vector:

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Type: N/A

Version:

Base score:

Base severity: N/A

Vector:

Weaknesses

CWE ID	Type	Source
CWE-835	Secondary	security-advisories@github.com

CWE ID: CWE-835

Type: Secondary

Source: security-advisories@github.com

References

Hyperlink	Source	Resource
https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5	security-advisories@github.com	N/A
https://github.com/isaacs/node-tar/releases/tag/v7.5.18	security-advisories@github.com	N/A
https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w	security-advisories@github.com	N/A
https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w	134c704f-9b21-4f2e-91b3-4a467353bcc0	N/A