{"schemaVersion":3,"id":"CVE-2026-59871","aliases":["UBUNTU-CVE-2026-59871","DEBIAN-CVE-2026-59871","CGA-3v28-4m36-h6q3","CGA-3vf2-g9jq-54qf","CGA-3vxv-r8mg-xwm2","CGA-55gx-7j7x-xr4j","CGA-5gc7-mr4f-fhhj","CGA-5q8w-m9rx-wx6p","CGA-6933-27v7-xhxx","CGA-6r44-7935-f287","CGA-6wf6-x367-3v5q","CGA-763f-4gx3-w7jm","CGA-9f3c-vw62-4q3m","CGA-c56v-wg5w-mg2c","CGA-c5qg-f29w-r8rv","CGA-c96r-gh5v-q49g","CGA-fr9j-qv84-68qc","CGA-gf8f-xr4c-6j3h","CGA-gw8f-hp94-3rwg","CGA-h82x-fhwp-m99g","CGA-h8c7-9x5g-qwwr","CGA-hcc2-j8h4-wx75","CGA-hh5x-fg4g-9r6f","CGA-hrv2-368x-rrxq","CGA-jcg7-q83h-5fxf","CGA-rgmw-hvvg-x37w","CGA-rw78-hwwj-vwx8","CGA-vcgw-rrjv-g37c","CGA-wf8f-8wwp-qqq9","CGA-xp53-qv6f-vcw8","GHSA-w8wr-v893-vjvp","CGA-27w7-cjrq-5886","CGA-28pp-v5r6-5h54","CGA-2983-69wg-p77r","CGA-2rwf-wrf9-37pp","CGA-32q9-8rjf-7hr2","CGA-35q8-23rj-jjx7","CGA-39jm-722j-v637","CGA-3ff9-x3jp-frhp","CGA-3fg7-4rpv-7r8p","CGA-44f9-8jv6-jr74","CGA-4f38-r27g-68pc","CGA-4gh3-gc53-v9x6","CGA-4j4x-q23r-v73j","CGA-55pm-vwj5-qf7j","CGA-55rw-j3wr-p99p","CGA-5898-4j7q-62wx","CGA-58qg-9629-qfmp","CGA-5j34-q46g-5h84","CGA-5vqx-5c8r-8p6m","CGA-63mm-p3qj-r785","CGA-652r-gp3j-fp49","CGA-6hf6-w3ph-rxx9","CGA-6hwf-qrj3-x624","CGA-6q8m-4r69-wmrg","CGA-6r22-c6gh-84qw","CGA-7j29-mjm4-3mw3","CGA-7q3w-6c6j-88m5","CGA-7wcf-v992-x3vj","CGA-7wmx-3xx7-ff2q","CGA-8gc3-h988-g6fv","CGA-8vcv-qfp2-wh3g","CGA-8w6c-wrqv-xcxc","CGA-8wx3-fjh2-74qg","CGA-9768-3pwq-84qp","CGA-9f96-mrwv-mfm6","CGA-9v4j-mgf8-386c","CGA-c4r5-m55r-c643","CGA-c8v2-pwqc-wgpv","CGA-c9q8-hf9x-c3pf","CGA-cg4c-gcgc-mgc7","CGA-f5xg-5f2v-gjpq","CGA-f8p8-jcgc-3m3q","CGA-ffxr-p8pf-qcpp","CGA-fpw5-f5vp-w36g","CGA-frh3-prgm-47xw","CGA-fxqf-pqxm-fwrm","CGA-g8jx-g94f-h56v","CGA-gxj4-vwwq-mmr7","CGA-h5jg-33r9-2jvc","CGA-h652-7qch-grp4","CGA-hj3f-ff7x-v5cv","CGA-hm9v-wrjc-rqcm","CGA-j2mx-7mhp-8wcv","CGA-j5rh-rq9p-wh8x","CGA-j78w-7wxf-7fmp","CGA-jj65-xg5w-9758","CGA-jjwc-r82p-7xwj","CGA-jpr9-qhxm-4ch4","CGA-jr3h-9583-wv3g","CGA-m534-x74x-2rjg","CGA-mc6f-f8hf-52rj","CGA-mf63-3v7f-578f","CGA-mfm8-4r98-c6vg","CGA-mw2x-f6cm-73j4","CGA-p3qx-8r3p-m752","CGA-p428-8j5w-rcx3","CGA-ph4x-4xhf-f225","CGA-px5m-3ghx-gpw5","CGA-q47p-3x76-894q","CGA-qc95-73p7-hgg6","CGA-qcww-mw9f-35gv","CGA-qpcf-cq25-22w2","CGA-qr4j-fg78-qwh6","CGA-r2fj-j5g8-2vrj","CGA-r33r-36wg-v92q","CGA-r5cr-vpv6-jrfr","CGA-r8vw-vv79-3xxq","CGA-r99p-629w-xfr3","CGA-rgqc-wq4x-m5qp","CGA-rj64-5383-6pcp","CGA-rw37-8cq6-pjg2","CGA-v7r4-762x-gff3","CGA-vgrw-cfvx-hxwq","CGA-vh37-q983-2wwc","CGA-vr7c-pc4c-9c2g","CGA-vv4f-68v7-xwjm","CGA-vw8m-pq9r-6jxm","CGA-w7qx-qxxp-x3q8","CGA-w8cj-2q89-7m89","CGA-w8v2-7j6v-42r8","CGA-wch6-xrwh-36f9","CGA-wcvm-736r-h77x","CGA-wmwr-32q4-pgj5","CGA-wvx2-x64q-vh9r","CGA-x236-q3p8-4324","CGA-x865-jqm3-w8p5","CGA-x8v5-7vrg-q9wh"],"status":"published","duplicateOf":null,"title":null,"description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPath(entry.path).split('/') to throw an uncaught TypeError. This issue is fixed in version 7.5.18.","dates":{"published":"2026-07-08T15:25:09.519Z","modified":"2026-07-08T16:13:05.563Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.5,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":10,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":10,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Wolfi","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","exploitability":10,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Npm","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","exploitability":10,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","exploitability":10,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00644,"percentile":0.4995,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.00644},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00644,"percentile":0.4995}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00644,"percentile":0.4995}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"GITHUB_ISAACS_NODE-TAR","name":"Node Tar","source":"github","url":"https://github.com/isaacs/node-tar/security/advisories/GHSA-f5x3-32g6-xq36","maturity":"poc","reliabilityScore":0.3,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-704","name":"Incorrect Type Conversion or Cast","description":"The product does not correctly convert an object, resource, or structure from one type to a different type.","type":"weakness","status":"Incomplete","abstraction":"Class","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/704.html"}],"affected":[{"vendor":"chainguard","product":"actions-runner","name":"actions-runner","label":"actions-runner","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/actions-runner","purlType":"apk","versions":[{"text":"< 2.336.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.336.0-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"code-server","name":"code-server","label":"code-server","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/code-server","purlType":"apk","versions":[{"text":"< 4.129.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.129.0-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.1","name":"gitlab-rails-ce-18.1","label":"gitlab-rails-ce-18.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.1","purlType":"apk","versions":[{"text":"< 18.1.6-r31","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.1.6-r31","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.10","name":"gitlab-rails-ce-18.10","label":"gitlab-rails-ce-18.10","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.10","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.6","name":"gitlab-rails-ce-18.6","label":"gitlab-rails-ce-18.6","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.6","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.7","name":"gitlab-rails-ce-18.7","label":"gitlab-rails-ce-18.7","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.7","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.8","name":"gitlab-rails-ce-18.8","label":"gitlab-rails-ce-18.8","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.8","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.9","name":"gitlab-rails-ce-18.9","label":"gitlab-rails-ce-18.9","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.9","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-19.0","name":"gitlab-rails-ce-19.0","label":"gitlab-rails-ce-19.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-19.0","purlType":"apk","versions":[{"text":"< 19.0.4-r10","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.0.4-r10","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-19.1","name":"gitlab-rails-ce-19.1","label":"gitlab-rails-ce-19.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-19.1","purlType":"apk","versions":[{"text":"< 19.1.2-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.1.2-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-19.2","name":"gitlab-rails-ce-19.2","label":"gitlab-rails-ce-19.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-19.2","purlType":"apk","versions":[{"text":"< 19.2.2-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.2.2-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.1","name":"gitlab-rails-ce-fips-18.1","label":"gitlab-rails-ce-fips-18.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.1","purlType":"apk","versions":[{"text":"< 18.1.6-r61","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.1.6-r61","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.10","name":"gitlab-rails-ce-fips-18.10","label":"gitlab-rails-ce-fips-18.10","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.10","purlType":"apk","versions":[{"text":"< 18.10.8-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.10.8-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.11","name":"gitlab-rails-ce-fips-18.11","label":"gitlab-rails-ce-fips-18.11","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.11","purlType":"apk","versions":[{"text":"< 18.11.12-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.11.12-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.6","name":"gitlab-rails-ce-fips-18.6","label":"gitlab-rails-ce-fips-18.6","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.6","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.7","name":"gitlab-rails-ce-fips-18.7","label":"gitlab-rails-ce-fips-18.7","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.7","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.8","name":"gitlab-rails-ce-fips-18.8","label":"gitlab-rails-ce-fips-18.8","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.8","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.9","name":"gitlab-rails-ce-fips-18.9","label":"gitlab-rails-ce-fips-18.9","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.9","purlType":"apk","versions":[{"text":"< 18.9.8-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.9.8-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-19.0","name":"gitlab-rails-ce-fips-19.0","label":"gitlab-rails-ce-fips-19.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-19.0","purlType":"apk","versions":[{"text":"< 19.0.4-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.0.4-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-19.1","name":"gitlab-rails-ce-fips-19.1","label":"gitlab-rails-ce-fips-19.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-19.1","purlType":"apk","versions":[{"text":"< 19.1.2-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.1.2-r9","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-19.2","name":"gitlab-rails-ce-fips-19.2","label":"gitlab-rails-ce-fips-19.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-19.2","purlType":"apk","versions":[{"text":"< 19.2.1-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.2.1-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"graalvm-25-ce-nodejs","name":"graalvm-25-ce-nodejs","label":"graalvm-25-ce-nodejs","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/graalvm-25-ce-nodejs","purlType":"apk","versions":[{"text":"< 25.0.4-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 25.0.4-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"homepage","name":"homepage","label":"homepage","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/homepage","purlType":"apk","versions":[{"text":"< 1.13.2-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.13.2-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jupyter-base-notebook","name":"jupyter-base-notebook","label":"jupyter-base-notebook","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jupyter-base-notebook","purlType":"apk","versions":[{"text":"< 7.6.3-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.6.3-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.0","name":"kibana-9.0","label":"kibana-9.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.0","purlType":"apk","versions":[{"text":"< 9.0.8-r34","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.0.8-r34","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.0-bitnami","name":"kibana-9.0-bitnami","label":"kibana-9.0-bitnami","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.0-bitnami","purlType":"apk","versions":[{"text":"< 9.0.8-r34","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.0.8-r34","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.0-iamguarded","name":"kibana-9.0-iamguarded","label":"kibana-9.0-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.0-iamguarded","purlType":"apk","versions":[{"text":"< 9.0.8-r34","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.0.8-r34","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.2","name":"kibana-9.2","label":"kibana-9.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.2","purlType":"apk","versions":[{"text":"< 9.2.8-r17","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.2.8-r17","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.2-iamguarded","name":"kibana-9.2-iamguarded","label":"kibana-9.2-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.2-iamguarded","purlType":"apk","versions":[{"text":"< 9.2.8-r17","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.2.8-r17","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kubeflow-centraldashboard","name":"kubeflow-centraldashboard","label":"kubeflow-centraldashboard","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kubeflow-centraldashboard","purlType":"apk","versions":[{"text":"< 1.10.0-r25","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.10.0-r25","eol":null,"hubHref":null},{"vendor":"chainguard","product":"lerna","name":"lerna","label":"lerna","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/lerna","purlType":"apk","versions":[{"text":"< 9.0.7-r11","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.0.7-r11","eol":null,"hubHref":null},{"vendor":"chainguard","product":"npm","name":"npm","label":"npm","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/npm","purlType":"apk","versions":[{"text":"< 12.0.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 12.0.0-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-dashboards-2","name":"opensearch-dashboards-2","label":"opensearch-dashboards-2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-dashboards-2","purlType":"apk","versions":[{"text":"< 2.19.6-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.6-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-dashboards-2-fips","name":"opensearch-dashboards-2-fips","label":"opensearch-dashboards-2-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-dashboards-2-fips","purlType":"apk","versions":[{"text":"< 2.19.5-r18","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.5-r18","eol":null,"hubHref":null},{"vendor":"chainguard","product":"pnpm-stage0","name":"pnpm-stage0","label":"pnpm-stage0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/pnpm-stage0","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"prism","name":"prism","label":"prism","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/prism","purlType":"apk","versions":[{"text":"< 5.16.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.16.0-r1","eol":{"isEol":null,"eolDate":null,"matchMethod":"alias_exact","cycle":null,"product":{"name":"nutanix-prism","label":"Nutanix Prism Central","category":"server-app"}},"hubHref":null},{"vendor":"chainguard","product":"pulumi-language-nodejs","name":"pulumi-language-nodejs","label":"pulumi-language-nodejs","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/pulumi-language-nodejs","purlType":"apk","versions":[{"text":"< 3.253.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.253.0-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"saf","name":"saf","label":"saf","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/saf","purlType":"apk","versions":[{"text":"< 1.6.0-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.6.0-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"sqlpad","name":"sqlpad","label":"sqlpad","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/sqlpad","purlType":"apk","versions":[{"text":"< 7.5.7-r29","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.5.7-r29","eol":null,"hubHref":null},{"vendor":"chainguard","product":"tensorflow-gpu-jupyter","name":"tensorflow-gpu-jupyter","label":"tensorflow-gpu-jupyter","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/tensorflow-gpu-jupyter","purlType":"apk","versions":[{"text":"< 2.21.0-r12","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.21.0-r12","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard","name":"wazuh-dashboard","label":"wazuh-dashboard","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard","purlType":"apk","versions":[{"text":"< 4.14.6-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.6-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-fips","name":"wazuh-dashboard-fips","label":"wazuh-dashboard-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-fips","purlType":"apk","versions":[{"text":"< 4.14.6-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.6-r4","eol":null,"hubHref":null},{"vendor":"wolfi","product":"code-server","name":"code-server","label":"code-server","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/code-server","purlType":"apk","versions":[{"text":"< 4.129.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.129.0-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"jupyter-base-notebook","name":"jupyter-base-notebook","label":"jupyter-base-notebook","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/jupyter-base-notebook","purlType":"apk","versions":[{"text":"< 7.6.3-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.6.3-r2","eol":null,"hubHref":null},{"vendor":"wolfi","product":"kubeflow-centraldashboard","name":"kubeflow-centraldashboard","label":"kubeflow-centraldashboard","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/kubeflow-centraldashboard","purlType":"apk","versions":[{"text":"< 1.10.0-r25","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.10.0-r25","eol":null,"hubHref":null},{"vendor":"wolfi","product":"lerna","name":"lerna","label":"lerna","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/lerna","purlType":"apk","versions":[{"text":"< 9.0.7-r11","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.0.7-r11","eol":null,"hubHref":null},{"vendor":"wolfi","product":"npm","name":"npm","label":"npm","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/npm","purlType":"apk","versions":[{"text":"< 12.0.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 12.0.0-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"pnpm-stage0","name":"pnpm-stage0","label":"pnpm-stage0","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/pnpm-stage0","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"wolfi","product":"prism","name":"prism","label":"prism","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/prism","purlType":"apk","versions":[{"text":"< 5.16.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.16.0-r1","eol":{"isEol":null,"eolDate":null,"matchMethod":"alias_exact","cycle":null,"product":{"name":"nutanix-prism","label":"Nutanix Prism Central","category":"server-app"}},"hubHref":null},{"vendor":"wolfi","product":"pulumi-language-nodejs","name":"pulumi-language-nodejs","label":"pulumi-language-nodejs","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/pulumi-language-nodejs","purlType":"apk","versions":[{"text":"< 3.253.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.253.0-r2","eol":null,"hubHref":null},{"vendor":"wolfi","product":"saf","name":"saf","label":"saf","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/saf","purlType":"apk","versions":[{"text":"< 1.6.0-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.6.0-r3","eol":null,"hubHref":null},{"vendor":"wolfi","product":"sqlpad","name":"sqlpad","label":"sqlpad","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/sqlpad","purlType":"apk","versions":[{"text":"< 7.5.7-r29","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.5.7-r29","eol":null,"hubHref":null},{"vendor":"debian","product":"node-tar","name":"node-tar","label":"node-tar","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/node-tar","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 7.5.19+~4.0.1-1","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 7.5.19+~4.0.1-1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"node-tar","name":"node-tar","label":"node-tar","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/node-tar","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"isaacs","product":"node-tar","name":"node-tar","label":"node-tar","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 7.5.18","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.5.18","eol":null,"hubHref":"/vendor/isaacs/node-tar"},{"vendor":"isaacs","product":"tar","name":"tar","label":"tar","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 7.5.18","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.5.18","eol":null,"hubHref":"/vendor/isaacs/tar"},{"vendor":"Npm","product":"tar","name":"tar","label":"tar","ecosystem":"Npm","cpePart":null,"purl":"pkg:npm/tar","purlType":"npm","versions":[{"text":"< 7.5.18","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.5.18","eol":null,"hubHref":null}],"affectedCount":57,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/isaacs/node-tar/security/advisories/GHSA-w8wr-v893-vjvp","label":"github.com/isaacs/node-tar/security/advisories/GHSA-w8wr-v893-vjvp","hostname":"github.com","tags":["X Refsource CONFIRM","REPORT","Advisory","WEB","Exploit","Vendor Advisory"]},{"url":"https://github.com/isaacs/node-tar/commit/e02a4e9e013c4be95302e2eb2047a942b883c27b","label":"github.com/isaacs/node-tar/commit/e02a4e9e013c4be95302e2eb2047a942b883c27b","hostname":"github.com","tags":["X Refsource MISC","FIX","WEB","Patch"]},{"url":"https://github.com/isaacs/node-tar/releases/tag/v7.5.18","label":"github.com/isaacs/node-tar/releases/tag/v7.5.18","hostname":"github.com","tags":["X Refsource MISC","WEB","Release Notes"]},{"url":"https://ubuntu.com/security/CVE-2026-59871","label":"ubuntu.com/security/CVE-2026-59871","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59871","label":"www.cve.org/CVERecord?id=CVE-2026-59871","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-59871","label":"security-tracker.debian.org/tracker/CVE-2026-59871","hostname":"security-tracker.debian.org","tags":["Advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59871.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59871.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59871","label":"nvd.nist.gov/vuln/detail/CVE-2026-59871","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/isaacs/node-tar","label":"github.com/isaacs/node-tar","hostname":"github.com","tags":["PACKAGE"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":["CGA-8FJF-9H72-4VFP"]},"timeline":[{"kind":"published","date":"2026-07-08T15:25:09.519Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-07-08T16:13:05.563Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":40,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T01:52:52.027Z","stale":false,"partial":false}}