Bug 2498115 (CVE-2026-59875) - CVE-2026-59875 node-tar: node-tar: Denial of Service via crafted archive with NUL bytes in metadata
Summary: CVE-2026-59875 node-tar: node-tar: Denial of Service via crafted archive with...
Keywords:
Status: NEW
Alias: CVE-2026-59875
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2498773 2498774 2498775 2498776 2498777 2498778 2498779 2498780 2498781 2498782 2498783 2498784 2498785 2498786 2498787
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-07-08 16:01 UTC by OSIDB Bzimport
Modified: 2026-07-09 21:48 UTC (History)
118 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-07-08 16:01:28 UTC 
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.lstat or fs.open and terminate the process with an uncaught exception. This issue is fixed in version 7.5.17.
Note You need to log in before you can comment on or make changes to this bug.