CVE-2026-59871

A flaw was found in node-tar, a library for manipulating tar archives in Node.js. This vulnerability occurs when the library incorrectly converts specific archive path values into numbers, leading to an error during subsequent path processing. An attacker could exploit this to cause the application using node-tar to crash, resulting in a denial of service.

This Moderate severity flaw in node-tar can lead to a denial of service in Node.js applications that process untrusted tar archives. A specially crafted archive with an all-digit PAX path value can cause an uncaught TypeError during path handling, resulting in an application crash that bypasses typical error recovery mechanisms.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.