CVE-2026-59874: node-tar: Negative tar entry size causes infinite loop in archive replace

July 20, 2026

A checksum-valid tar archive with a negative base-256 encoded entry size can make tar.replace() loop forever while scanning the existing archive. Applications that update attacker-controlled tar archives can have a worker process pinned indefinitely, causing denial of service.

References

github.com/advisories/GHSA-8x88-c5mf-7j5w
github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5
github.com/isaacs/node-tar/releases/tag/v7.5.18
github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w
nvd.nist.gov/vuln/detail/CVE-2026-59874

Code Behaviors & Features

Detect and mitigate CVE-2026-59874 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →