Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-59871

node-tar: Process crash via PAX numeric path type confusion

Description

node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPath(entry.path).split('/') to throw an uncaught TypeError. This issue is fixed in version 7.5.18.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

isaacs node-tar

  • < 7.5.18affected

References