CVE-2026-59871

Name	CVE-2026-59871
Description	node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPath(entry.path).split('/') to throw an uncaught TypeError. This issue is fixed in version 7.5.18.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1141767

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
node-tar (PTS)	bullseye	6.0.5+ds1+~cs11.3.9-1+deb11u2	vulnerable
	bullseye (security)	6.0.5+ds1+~cs11.3.9-1+deb11u3	vulnerable
	bookworm	6.1.13+~cs7.0.5-1	vulnerable
	trixie	6.2.1+~cs7.0.8-1+deb13u1	vulnerable
	forky	6.2.1+ds1+~cs6.1.13-10	vulnerable
	sid	7.5.19+~4.0.1-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
node-tar	source	(unstable)	7.5.19+~4.0.1-1			1141767

Notes

[trixie] - node-tar <no-dsa> (Minor issue)
https://github.com/isaacs/node-tar/security/advisories/GHSA-w8wr-v893-vjvp
Fixed by: https://github.com/isaacs/node-tar/commit/e02a4e9e013c4be95302e2eb2047a942b883c27b (v7.5.18)