{"schemaVersion":3,"id":"CVE-2026-59873","aliases":["UBUNTU-CVE-2026-59873","DEBIAN-CVE-2026-59873","CGA-2r32-2w73-wxxc","CGA-3r44-fcv7-5fj7","CGA-44f2-x88m-252r","CGA-6877-mv57-g2r8","CGA-7j38-x3jm-hc97","CGA-8cmf-x5ch-rh37","CGA-9xgg-g2vm-93vp","CGA-cjw7-h6mc-wf9j","CGA-cpqq-98h8-4qvv","CGA-f8p5-q2xj-327x","CGA-ffr4-mxph-9rwq","CGA-fg9m-7jq7-gvh7","CGA-fwrh-43vr-q74q","CGA-g3qq-qmh6-362g","CGA-g8m5-6fpw-hh3h","CGA-hxjr-75xr-3m9c","CGA-jh7w-h7qf-7q74","CGA-jhwp-j944-pm6j","CGA-jvqp-jrmr-m2fc","CGA-mqv4-hwjx-gmgg","CGA-qcj3-whcr-5hv2","CGA-rx3q-frf9-96xg","CGA-v453-cqjf-hwfc","CGA-v46p-3cwp-mfq3","CGA-w28j-p9gq-x49x","CGA-w7jf-7r63-3h68","CGA-wwhq-cx45-3vc8","CGA-xvc7-q38x-9cx2","GHSA-23hp-3jrh-7fpw","CGA-2jpv-m58g-r8mm","CGA-2v43-9h3c-4vmx","CGA-45h6-2xhc-782g","CGA-48x5-jc4f-c9p3","CGA-4qcm-gfx6-8433","CGA-5234-c9x7-6g6g","CGA-53h5-7x4m-5q3f","CGA-53m2-77q6-4fp6","CGA-5449-pf4r-cw9g","CGA-58m5-wxfx-3h25","CGA-5cfh-qrfm-j43q","CGA-66vv-7j73-7x27","CGA-6hfh-pfmv-r9j5","CGA-6mgx-pj79-pw6m","CGA-6qpq-qg9q-p8h2","CGA-72mm-6q2f-m5r2","CGA-74xc-v2rj-rj6r","CGA-7564-jwjp-gfh7","CGA-7gw6-gp6w-fpm2","CGA-7ppf-2886-xrpv","CGA-8392-5wfj-82r9","CGA-8fj6-prg7-rghp","CGA-8h79-g8h2-3j9m","CGA-8jmj-mj9h-wx2x","CGA-8jph-v9fp-9h5p","CGA-95m7-gchx-jv52","CGA-9rfq-j5jf-h6xq","CGA-9vgm-ffxx-3jcm","CGA-9w25-g3fj-jh5g","CGA-cgmj-jwcr-8xh9","CGA-cjr5-jxrh-25m2","CGA-cwh8-vm5v-7ff8","CGA-f7gq-84x8-8f8h","CGA-fjf5-gxv7-x86w","CGA-g3ph-w7c3-6w5j","CGA-g6h7-h4x6-g4wj","CGA-g88h-4mq3-c555","CGA-gh8p-9qpv-gg7f","CGA-gm8w-4vmm-r2p9","CGA-gm94-qgr2-wg3p","CGA-gmvf-74g5-ffwh","CGA-grvf-3ggp-hh3f","CGA-gxx3-2g8r-52j9","CGA-h9jh-6qrw-jc76","CGA-hfgv-48f4-pcx2","CGA-hjm3-9jjh-q7v2","CGA-hm35-hxfv-3x48","CGA-hp5h-wwrh-pv7j","CGA-hpph-hq8r-xg3p","CGA-j4h2-ww2h-hf9w","CGA-jjmm-5cc2-p37q","CGA-jvrx-8xq7-mf8m","CGA-jx7j-gw68-m69p","CGA-m77q-m498-p264","CGA-mgjp-36x4-7f58","CGA-mhm2-6gf4-rxx8","CGA-mjqw-qjv4-vg8g","CGA-mq3p-4chw-5j5h","CGA-mvfp-93m7-5h64","CGA-p3x3-pjxg-6gqq","CGA-p9j9-9hx8-mhjw","CGA-pghr-8wj3-p23r","CGA-pp7q-rj5c-4r78","CGA-pqhv-368w-mjx2","CGA-q4hc-j6j3-3jv2","CGA-q59v-wp6x-r4pv","CGA-qjp2-69pf-6897","CGA-qvm2-9gpg-c76j","CGA-qwjr-4v65-pg74","CGA-r85j-w63m-r84r","CGA-r9rv-mq4r-2pfp","CGA-rfrp-3rq2-6cfh","CGA-rq73-jm44-m453","CGA-rwwq-rxpr-jr6r","CGA-v47f-jvpw-r99g","CGA-v6qc-5cwv-j2g5","CGA-v98w-mm7j-pwm6","CGA-vcrc-qrqf-mf82","CGA-vm2h-cffj-jr37","CGA-vm4f-g96f-jrqh","CGA-vm8j-2ppm-6pr9","CGA-vmrr-m6f7-4xxw","CGA-vxv4-94qj-mwpv","CGA-w3xx-rhhf-vv6v","CGA-w44v-cp4x-98qf","CGA-w648-2j8r-r3jh","CGA-w9ww-3x53-m2x5","CGA-wxwp-jm6f-54c8","CGA-x2g6-5jcw-q287","CGA-x6pc-7mc6-6pp5","CGA-x7m4-4q3j-xq5c","CGA-xgf6-qjrf-qm67","CGA-xgq7-5w2r-qqf6","CGA-xh3r-86gr-8m9h","CGA-xhq6-97h9-p4p8","CGA-xpmq-cpfv-f267","CGA-xr5h-c6cr-r4cw"],"status":"published","duplicateOf":null,"title":null,"description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as src/extract.ts, allowing a small crafted gzip bomb to exhaust disk space and CPU. This issue is fixed in version 7.5.19.","dates":{"published":"2026-07-08T15:22:40.077Z","modified":"2026-07-08T19:41:26.372Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":9.2,"severity":"critical","version":"4.0","versionLabel":"v4.0","source":"CVE.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"4.0","versionLabel":"v4.0","source":"CVE.org","score":9.2,"severity":"critical","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Ubuntu","score":9.2,"severity":"critical","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","exploitability":null,"impact":null,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":10,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":10,"impact":6,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Wolfi","score":9.2,"severity":"critical","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Npm","score":9.2,"severity":"critical","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","exploitability":null,"impact":null,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Npm","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":10,"impact":6,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Chainguard","score":9.2,"severity":"critical","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"NVD","score":9.2,"severity":"critical","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00582,"percentile":0.47058,"severity":"low","asOf":"2026-10-22T00:00:00.000Z","change":{"pp":0.02599999999999998,"baselineDate":"2026-09-22T00:00:00.000Z","baselineScore":0.00556},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00556,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00556,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00556,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00556,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00556,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00556,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00556,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00556,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00556,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00556,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00582,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00582,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00582,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00582,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00582,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00582,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00582,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00582,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00582,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00582,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00582,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00582,"percentile":null},{"date":"2026-10-22T00:00:00.000Z","score":0.00582,"percentile":0.47058}],"last30":[{"date":"2026-09-22T00:00:00.000Z","score":0.00556,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00556,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00582,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00582,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00582,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00582,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00582,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00582,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00582,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00582,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00582,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00582,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00582,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00582,"percentile":null},{"date":"2026-10-22T00:00:00.000Z","score":0.00582,"percentile":0.47058}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"GITHUB_ISAACS_NODE-TAR","name":"Node Tar","source":"github","url":"https://github.com/isaacs/node-tar/security/advisories/GHSA-f5x3-32g6-xq36","maturity":"poc","reliabilityScore":0.3,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-770","name":"Allocation of Resources Without Limits or Throttling","description":"The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/770.html"}],"affected":[{"vendor":"chainguard","product":"actions-runner","name":"actions-runner","label":"actions-runner","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/actions-runner","purlType":"apk","versions":[{"text":"< 2.336.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.336.0-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"code-server","name":"code-server","label":"code-server","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/code-server","purlType":"apk","versions":[{"text":"< 4.129.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.129.0-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.1","name":"gitlab-rails-ce-18.1","label":"gitlab-rails-ce-18.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.1","purlType":"apk","versions":[{"text":"< 18.1.6-r31","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.1.6-r31","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.10","name":"gitlab-rails-ce-18.10","label":"gitlab-rails-ce-18.10","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.10","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.6","name":"gitlab-rails-ce-18.6","label":"gitlab-rails-ce-18.6","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.6","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.7","name":"gitlab-rails-ce-18.7","label":"gitlab-rails-ce-18.7","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.7","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.8","name":"gitlab-rails-ce-18.8","label":"gitlab-rails-ce-18.8","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.8","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.9","name":"gitlab-rails-ce-18.9","label":"gitlab-rails-ce-18.9","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.9","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-19.0","name":"gitlab-rails-ce-19.0","label":"gitlab-rails-ce-19.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-19.0","purlType":"apk","versions":[{"text":"< 19.0.4-r10","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.0.4-r10","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-19.1","name":"gitlab-rails-ce-19.1","label":"gitlab-rails-ce-19.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-19.1","purlType":"apk","versions":[{"text":"< 19.1.2-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.1.2-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-19.2","name":"gitlab-rails-ce-19.2","label":"gitlab-rails-ce-19.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-19.2","purlType":"apk","versions":[{"text":"< 19.2.2-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.2.2-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.1","name":"gitlab-rails-ce-fips-18.1","label":"gitlab-rails-ce-fips-18.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.1","purlType":"apk","versions":[{"text":"< 18.1.6-r61","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.1.6-r61","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.10","name":"gitlab-rails-ce-fips-18.10","label":"gitlab-rails-ce-fips-18.10","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.10","purlType":"apk","versions":[{"text":"< 18.10.8-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.10.8-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.11","name":"gitlab-rails-ce-fips-18.11","label":"gitlab-rails-ce-fips-18.11","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.11","purlType":"apk","versions":[{"text":"< 18.11.12-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.11.12-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.6","name":"gitlab-rails-ce-fips-18.6","label":"gitlab-rails-ce-fips-18.6","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.6","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.7","name":"gitlab-rails-ce-fips-18.7","label":"gitlab-rails-ce-fips-18.7","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.7","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.8","name":"gitlab-rails-ce-fips-18.8","label":"gitlab-rails-ce-fips-18.8","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.8","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.9","name":"gitlab-rails-ce-fips-18.9","label":"gitlab-rails-ce-fips-18.9","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.9","purlType":"apk","versions":[{"text":"< 18.9.8-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.9.8-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-19.0","name":"gitlab-rails-ce-fips-19.0","label":"gitlab-rails-ce-fips-19.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-19.0","purlType":"apk","versions":[{"text":"< 19.0.4-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.0.4-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-19.1","name":"gitlab-rails-ce-fips-19.1","label":"gitlab-rails-ce-fips-19.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-19.1","purlType":"apk","versions":[{"text":"< 19.1.2-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.1.2-r9","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-19.2","name":"gitlab-rails-ce-fips-19.2","label":"gitlab-rails-ce-fips-19.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-19.2","purlType":"apk","versions":[{"text":"< 19.2.1-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.2.1-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"graalvm-25-ce-nodejs","name":"graalvm-25-ce-nodejs","label":"graalvm-25-ce-nodejs","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/graalvm-25-ce-nodejs","purlType":"apk","versions":[{"text":"< 25.0.4-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 25.0.4-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"homepage","name":"homepage","label":"homepage","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/homepage","purlType":"apk","versions":[{"text":"< 1.13.2-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.13.2-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jupyter-base-notebook","name":"jupyter-base-notebook","label":"jupyter-base-notebook","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jupyter-base-notebook","purlType":"apk","versions":[{"text":"< 7.6.3-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.6.3-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.0","name":"kibana-9.0","label":"kibana-9.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.0","purlType":"apk","versions":[{"text":"< 9.0.8-r34","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.0.8-r34","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.0-bitnami","name":"kibana-9.0-bitnami","label":"kibana-9.0-bitnami","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.0-bitnami","purlType":"apk","versions":[{"text":"< 9.0.8-r34","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.0.8-r34","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.0-iamguarded","name":"kibana-9.0-iamguarded","label":"kibana-9.0-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.0-iamguarded","purlType":"apk","versions":[{"text":"< 9.0.8-r34","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.0.8-r34","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.2","name":"kibana-9.2","label":"kibana-9.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.2","purlType":"apk","versions":[{"text":"< 9.2.8-r17","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.2.8-r17","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.2-iamguarded","name":"kibana-9.2-iamguarded","label":"kibana-9.2-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.2-iamguarded","purlType":"apk","versions":[{"text":"< 9.2.8-r17","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.2.8-r17","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kubeflow-centraldashboard","name":"kubeflow-centraldashboard","label":"kubeflow-centraldashboard","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kubeflow-centraldashboard","purlType":"apk","versions":[{"text":"< 1.10.0-r25","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.10.0-r25","eol":null,"hubHref":null},{"vendor":"chainguard","product":"lerna","name":"lerna","label":"lerna","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/lerna","purlType":"apk","versions":[{"text":"< 9.0.7-r11","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.0.7-r11","eol":null,"hubHref":null},{"vendor":"chainguard","product":"npm","name":"npm","label":"npm","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/npm","purlType":"apk","versions":[{"text":"< 12.0.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 12.0.0-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-dashboards-2","name":"opensearch-dashboards-2","label":"opensearch-dashboards-2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-dashboards-2","purlType":"apk","versions":[{"text":"< 2.19.6-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.6-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-dashboards-2-fips","name":"opensearch-dashboards-2-fips","label":"opensearch-dashboards-2-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-dashboards-2-fips","purlType":"apk","versions":[{"text":"< 2.19.5-r18","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.5-r18","eol":null,"hubHref":null},{"vendor":"chainguard","product":"pnpm-stage0","name":"pnpm-stage0","label":"pnpm-stage0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/pnpm-stage0","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"prism","name":"prism","label":"prism","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/prism","purlType":"apk","versions":[{"text":"< 5.16.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.16.0-r1","eol":{"isEol":null,"eolDate":null,"matchMethod":"alias_exact","cycle":null,"product":{"name":"nutanix-prism","label":"Nutanix Prism Central","category":"server-app"}},"hubHref":null},{"vendor":"chainguard","product":"pulumi-language-nodejs","name":"pulumi-language-nodejs","label":"pulumi-language-nodejs","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/pulumi-language-nodejs","purlType":"apk","versions":[{"text":"< 3.253.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.253.0-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"saf","name":"saf","label":"saf","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/saf","purlType":"apk","versions":[{"text":"< 1.6.0-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.6.0-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"sqlpad","name":"sqlpad","label":"sqlpad","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/sqlpad","purlType":"apk","versions":[{"text":"< 7.5.7-r29","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.5.7-r29","eol":null,"hubHref":null},{"vendor":"chainguard","product":"tensorflow-gpu-jupyter","name":"tensorflow-gpu-jupyter","label":"tensorflow-gpu-jupyter","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/tensorflow-gpu-jupyter","purlType":"apk","versions":[{"text":"< 2.21.0-r12","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.21.0-r12","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard","name":"wazuh-dashboard","label":"wazuh-dashboard","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard","purlType":"apk","versions":[{"text":"< 4.14.6-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.6-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-fips","name":"wazuh-dashboard-fips","label":"wazuh-dashboard-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-fips","purlType":"apk","versions":[{"text":"< 4.14.6-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.6-r4","eol":null,"hubHref":null},{"vendor":"wolfi","product":"code-server","name":"code-server","label":"code-server","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/code-server","purlType":"apk","versions":[{"text":"< 4.129.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.129.0-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"jupyter-base-notebook","name":"jupyter-base-notebook","label":"jupyter-base-notebook","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/jupyter-base-notebook","purlType":"apk","versions":[{"text":"< 7.6.3-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.6.3-r2","eol":null,"hubHref":null},{"vendor":"wolfi","product":"kubeflow-centraldashboard","name":"kubeflow-centraldashboard","label":"kubeflow-centraldashboard","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/kubeflow-centraldashboard","purlType":"apk","versions":[{"text":"< 1.10.0-r25","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.10.0-r25","eol":null,"hubHref":null},{"vendor":"wolfi","product":"lerna","name":"lerna","label":"lerna","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/lerna","purlType":"apk","versions":[{"text":"< 9.0.7-r11","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.0.7-r11","eol":null,"hubHref":null},{"vendor":"wolfi","product":"npm","name":"npm","label":"npm","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/npm","purlType":"apk","versions":[{"text":"< 12.0.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 12.0.0-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"pnpm-stage0","name":"pnpm-stage0","label":"pnpm-stage0","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/pnpm-stage0","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"wolfi","product":"prism","name":"prism","label":"prism","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/prism","purlType":"apk","versions":[{"text":"< 5.16.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.16.0-r1","eol":{"isEol":null,"eolDate":null,"matchMethod":"alias_exact","cycle":null,"product":{"name":"nutanix-prism","label":"Nutanix Prism Central","category":"server-app"}},"hubHref":null},{"vendor":"wolfi","product":"pulumi-language-nodejs","name":"pulumi-language-nodejs","label":"pulumi-language-nodejs","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/pulumi-language-nodejs","purlType":"apk","versions":[{"text":"< 3.253.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.253.0-r2","eol":null,"hubHref":null},{"vendor":"wolfi","product":"saf","name":"saf","label":"saf","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/saf","purlType":"apk","versions":[{"text":"< 1.6.0-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.6.0-r3","eol":null,"hubHref":null},{"vendor":"wolfi","product":"sqlpad","name":"sqlpad","label":"sqlpad","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/sqlpad","purlType":"apk","versions":[{"text":"< 7.5.7-r29","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.5.7-r29","eol":null,"hubHref":null},{"vendor":"debian","product":"node-tar","name":"node-tar","label":"node-tar","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/node-tar","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 7.5.19+~4.0.1-1","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 7.5.19+~4.0.1-1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"node-tar","name":"node-tar","label":"node-tar","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/node-tar","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"isaacs","product":"node-tar","name":"node-tar","label":"node-tar","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 7.5.19","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.5.19","eol":null,"hubHref":"/vendor/isaacs/node-tar"},{"vendor":"isaacs","product":"tar","name":"tar","label":"tar","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 7.5.19","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.5.19","eol":null,"hubHref":"/vendor/isaacs/tar"},{"vendor":"Npm","product":"tar","name":"tar","label":"tar","ecosystem":"Npm","cpePart":null,"purl":"pkg:npm/tar","purlType":"npm","versions":[{"text":"< 7.5.19","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.5.19","eol":null,"hubHref":null}],"affectedCount":57,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw","label":"github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw","hostname":"github.com","tags":["X Refsource CONFIRM","REPORT","Advisory","WEB","Exploit","Vendor Advisory"]},{"url":"https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3","label":"github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3","hostname":"github.com","tags":["X Refsource MISC","FIX","WEB","Patch"]},{"url":"https://github.com/isaacs/node-tar/releases/tag/v7.5.19","label":"github.com/isaacs/node-tar/releases/tag/v7.5.19","hostname":"github.com","tags":["X Refsource MISC","WEB","Release Notes"]},{"url":"https://ubuntu.com/security/CVE-2026-59873","label":"ubuntu.com/security/CVE-2026-59873","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59873","label":"www.cve.org/CVERecord?id=CVE-2026-59873","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-59873","label":"security-tracker.debian.org/tracker/CVE-2026-59873","hostname":"security-tracker.debian.org","tags":["Advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59873.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59873.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59873","label":"nvd.nist.gov/vuln/detail/CVE-2026-59873","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/isaacs/node-tar","label":"github.com/isaacs/node-tar","hostname":"github.com","tags":["PACKAGE"]}],"lineage":{"upstream":[],"downstream":["RHSA-2026:47057","RHSA-2026:47058","RHSA-2026:47059","RHSA-2026:47060","RHSA-2026:48033","RHSA-2026:48034","RHSA-2026:52399","RHSA-2026:53298","RHSA-2026:57590"],"duplicates":[],"related":["CGA-F6HX-JF27-FMR8"]},"timeline":[{"kind":"published","date":"2026-07-08T15:22:40.077Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-07-08T19:41:26.372Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":70,"level":"high","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T14:32:41.571Z","stale":false,"partial":false}}