PT-2026-56492
CVE-2026-59871
·
Published
2026-07-08
·
Updated
2026-11-05
Description by
CVSS 3.1
7.5
HighMetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions
node-tar versions prior to 7.5.18
Description
The library coerces all-digit PAX path and linkpath values in
src/pax.ts to JavaScript numbers. This behavior causes downstream path handling, such as normalizeWindowsPath(entry.path).split('/'), to throw an uncaught TypeError.Recommendations
Update to version 7.5.18.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾