CVE-2026-59873: isaacs node-tar
CVSS: 9.2v4.0CriticalAnalyzed
AliasesUBUNTU-CVE-2026-59873DEBIAN-CVE-2026-59873CGA-2r32-2w73-wxxcCGA-3r44-fcv7-5fj7CGA-44f2-x88m-252rCGA-6877-mv57-g2r8CGA-7j38-x3jm-hc97CGA-8cmf-x5ch-rh37CGA-9xgg-g2vm-93vpCGA-cjw7-h6mc-wf9jCGA-cpqq-98h8-4qvvCGA-f8p5-q2xj-327xCGA-ffr4-mxph-9rwqCGA-fg9m-7jq7-gvh7CGA-fwrh-43vr-q74qCGA-g3qq-qmh6-362gCGA-g8m5-6fpw-hh3hCGA-hxjr-75xr-3m9cCGA-jh7w-h7qf-7q74CGA-jhwp-j944-pm6jCGA-jvqp-jrmr-m2fcCGA-mqv4-hwjx-gmggCGA-qcj3-whcr-5hv2CGA-rx3q-frf9-96xgCGA-v453-cqjf-hwfcCGA-v46p-3cwp-mfq3CGA-w28j-p9gq-x49xCGA-w7jf-7r63-3h68CGA-wwhq-cx45-3vc8CGA-xvc7-q38x-9cx2GHSA-23hp-3jrh-7fpwCGA-2jpv-m58g-r8mmCGA-2v43-9h3c-4vmxCGA-45h6-2xhc-782gCGA-48x5-jc4f-c9p3CGA-4qcm-gfx6-8433CGA-5234-c9x7-6g6gCGA-53h5-7x4m-5q3fCGA-53m2-77q6-4fp6CGA-5449-pf4r-cw9gCGA-58m5-wxfx-3h25CGA-5cfh-qrfm-j43qCGA-66vv-7j73-7x27CGA-6hfh-pfmv-r9j5CGA-6mgx-pj79-pw6mCGA-6qpq-qg9q-p8h2CGA-72mm-6q2f-m5r2CGA-74xc-v2rj-rj6rCGA-7564-jwjp-gfh7CGA-7gw6-gp6w-fpm2CGA-7ppf-2886-xrpvCGA-8392-5wfj-82r9CGA-8fj6-prg7-rghpCGA-8h79-g8h2-3j9mCGA-8jmj-mj9h-wx2xCGA-8jph-v9fp-9h5pCGA-95m7-gchx-jv52CGA-9rfq-j5jf-h6xqCGA-9vgm-ffxx-3jcmCGA-9w25-g3fj-jh5gCGA-cgmj-jwcr-8xh9CGA-cjr5-jxrh-25m2CGA-cwh8-vm5v-7ff8CGA-f7gq-84x8-8f8hCGA-fjf5-gxv7-x86wCGA-g3ph-w7c3-6w5jCGA-g6h7-h4x6-g4wjCGA-g88h-4mq3-c555CGA-gh8p-9qpv-gg7fCGA-gm8w-4vmm-r2p9CGA-gm94-qgr2-wg3pCGA-gmvf-74g5-ffwhCGA-grvf-3ggp-hh3fCGA-gxx3-2g8r-52j9CGA-h9jh-6qrw-jc76CGA-hfgv-48f4-pcx2CGA-hjm3-9jjh-q7v2CGA-hm35-hxfv-3x48CGA-hp5h-wwrh-pv7jCGA-hpph-hq8r-xg3pCGA-j4h2-ww2h-hf9wCGA-jjmm-5cc2-p37qCGA-jvrx-8xq7-mf8mCGA-jx7j-gw68-m69pCGA-m77q-m498-p264CGA-mgjp-36x4-7f58CGA-mhm2-6gf4-rxx8CGA-mjqw-qjv4-vg8gCGA-mq3p-4chw-5j5hCGA-mvfp-93m7-5h64CGA-p3x3-pjxg-6gqqCGA-p9j9-9hx8-mhjwCGA-pghr-8wj3-p23rCGA-pp7q-rj5c-4r78CGA-pqhv-368w-mjx2CGA-q4hc-j6j3-3jv2CGA-q59v-wp6x-r4pvCGA-qjp2-69pf-6897CGA-qvm2-9gpg-c76jCGA-qwjr-4v65-pg74CGA-r85j-w63m-r84rCGA-r9rv-mq4r-2pfpCGA-rfrp-3rq2-6cfhCGA-rq73-jm44-m453CGA-rwwq-rxpr-jr6rCGA-v47f-jvpw-r99gCGA-v6qc-5cwv-j2g5CGA-v98w-mm7j-pwm6CGA-vcrc-qrqf-mf82CGA-vm2h-cffj-jr37CGA-vm4f-g96f-jrqhCGA-vm8j-2ppm-6pr9CGA-vmrr-m6f7-4xxwCGA-vxv4-94qj-mwpvCGA-w3xx-rhhf-vv6vCGA-w44v-cp4x-98qfCGA-w648-2j8r-r3jhCGA-w9ww-3x53-m2x5CGA-wxwp-jm6f-54c8CGA-x2g6-5jcw-q287CGA-x6pc-7mc6-6pp5CGA-x7m4-4q3j-xq5cCGA-xgf6-qjrf-qm67CGA-xgq7-5w2r-qqf6CGA-xh3r-86gr-8m9hCGA-xhq6-97h9-p4p8CGA-xpmq-cpfv-f267CGA-xr5h-c6cr-r4cw
Published 08-07-2026Last modified 08-07-2026
Vulnerability summary
CVE-2026-59873 is a critical (CVSS 9.2) vulnerability in isaacs node-tar. EPSS estimates a 0.58% chance of exploitation in the next 30 days, higher than 46.8% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
9.2/10
010
Critical · v4.0 (CVE.org)EPSS score
0.58%
0%100%
Low · +0.03 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Advisory lineage
Upstream 0 · Downstream 9 · Related 1Timeline
- 08-07-2026PublishedVulnerability first disclosed.
- 08-07-2026Last modifiedVulnerability information updated.
Description
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as src/extract.ts, allowing a small crafted gzip bomb to exhaust disk space and CPU. This issue is fixed in version 7.5.19.
CVSS metrics
10 scores · 7 sources · 2 versionsCritical 9.2Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:HSourcesAll 6 agree
- OSV · UbuntuEcosystem advisory · calculated9.2CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
- OSV · WolfiEcosystem advisory · calculated9.2CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
- OSV · NpmEcosystem advisory · calculated9.2CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
- OSV · ChainguardEcosystem advisory · calculated9.2CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
- NVDNIST9.2CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
High 7.5Preferred score · OSV · Ubuntu (Ecosystem advisory) · calculated from vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 4 agree
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · NpmEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.58%
Chance of exploitation in the next 30 days
Percentile
47%
Versus all other CVEs
30-day change
+0.03 pp
From 0.56% on 20-09-2026
20-09-202620-10-2026
EPSS score0.58%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundNode Tar
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Chainguard42 products
- actions-runner< 2.336.0-r1
- code-server< 4.129.0-r1
- gitlab-rails-ce-18.1< 18.1.6-r31
- gitlab-rails-ce-18.10All versions (No fix recorded)
- gitlab-rails-ce-18.6All versions (No fix recorded)
Wolfi10 products
- code-server< 4.129.0-r1
- jupyter-base-notebook< 7.6.3-r2
- kubeflow-centraldashboard< 1.10.0-r25
- lerna< 9.0.7-r11
- npm< 12.0.0-r1
Debian1 product
- node-tarAll versions (No fix recorded) | < 7.5.19+~4.0.1-1
Npm1 product
- tar< 7.5.19
Ubuntu1 product
- node-tarAll versions (No fix recorded)
6 vendors · 57 products
References
9 links- github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpwX Refsource CONFIRMREPORTAdvisoryWEBExploitVendor Advisory
- github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3X Refsource MISCFIXWEBPatch
- github.com/isaacs/node-tarPACKAGE