CVE-2026-59874: isaacs node-tar Infinite Loop
CVSS: 8.7v4.0HighAnalyzed
AliasesUBUNTU-CVE-2026-59874DEBIAN-CVE-2026-59874CGA-299p-7g48-hwxvCGA-3gc2-pc28-9286CGA-4jjp-gjfp-f9q3CGA-4wmw-m24v-c63pCGA-5pg6-rpf8-w9vhCGA-5q2c-qmhj-7mmgCGA-66j4-8mqm-cv9mCGA-69fm-qhfc-6583CGA-6g33-pr5x-h7c4CGA-6m7w-5v9q-rrh6CGA-756w-x636-r36qCGA-7933-v5hh-h5m7CGA-92m5-7ccg-7x2jCGA-f3hp-28w9-55wwCGA-frwr-rfhg-fjh4CGA-fvgq-g5c4-x44xCGA-g3qm-9rjv-46qhCGA-gw93-xj28-4c7hCGA-j524-2wxf-94c9CGA-j7qp-v7gh-w7c4CGA-jh5r-w458-x8g6CGA-jxrc-c7m8-w98jCGA-mwcj-7r6q-mvp5CGA-r9fr-vrjw-gmfjCGA-rgvw-wxr9-wrv8CGA-rmvh-x9m4-prrpCGA-v4qx-5ghm-4cj5CGA-x27m-g72g-g85jGHSA-8x88-c5mf-7j5wCGA-243w-jc8g-w7xxCGA-249f-8gx8-p5frCGA-27hf-wx88-pm4fCGA-28qh-cw34-mwcpCGA-2hrj-9x38-g52hCGA-2p75-2358-wr79CGA-2v5h-fvg8-qcm6CGA-2vvg-4x2r-xgqcCGA-2x4q-ph79-9qggCGA-33f2-gw92-hqcmCGA-3766-jgjc-9w2rCGA-3m3x-3mw8-c576CGA-3vmr-qgcw-h7wrCGA-42jh-5wx9-5p99CGA-42wr-gh6p-prqfCGA-45rc-v95g-2m94CGA-46j8-g92h-3cqxCGA-4cxf-qj7r-fjw7CGA-4p7h-j6vv-pqcfCGA-4qq3-85qm-32p2CGA-5875-w36m-gg3hCGA-5h3c-gw68-hh32CGA-5j35-5mf5-pjhxCGA-5pcp-h5w5-6fmrCGA-5rc2-g46m-8wvjCGA-6hw9-6q78-mh6wCGA-6p7m-6vjr-8224CGA-6w27-w2f5-r79gCGA-6xhr-cf73-8pm2CGA-72vp-jm2q-7w2pCGA-7g8p-pq45-x884CGA-7qmc-42vj-mqj6CGA-7rxm-c5jx-wmq2CGA-7xjg-737v-v6wwCGA-8989-9xw5-22vvCGA-89m6-hmpv-xr93CGA-8fpc-m75q-pgvjCGA-8jx6-6g37-ccfwCGA-8pjw-f96j-q9v3CGA-8r9p-mwqv-vgp2CGA-8rc8-mxwg-mjv2CGA-8ww7-j32f-h8x5CGA-8xmr-5whv-q9q4CGA-9mj9-q9hr-pq36CGA-9mvg-8mpm-2m7mCGA-c49c-8mmj-c238CGA-c52g-9jg2-9x2mCGA-cgq5-wg35-h257CGA-chq8-v8ph-r6v3CGA-f4x9-8x7f-58pwCGA-f873-499q-2mwxCGA-ffvp-pmvg-q886CGA-fj6f-7cq9-g4x9CGA-fmhr-p5jh-mm8qCGA-fp2v-gw2q-jcg2CGA-fq9h-3mfv-2hgmCGA-fqmv-7f24-q9xqCGA-gmrw-j6qv-g296CGA-gv52-wmxx-qgq5CGA-hf59-4rxv-8wq8CGA-hjm9-9wvw-7gpgCGA-hw3x-8jmx-jq3xCGA-j63q-cf5p-3w4cCGA-m2xc-94m4-w826CGA-m69c-6mrw-88r7CGA-m932-wcr9-v436CGA-mf6f-vfm4-pq3hCGA-mj96-qcj4-g733CGA-mrmm-qg4p-274gCGA-mvx4-rv9f-mpvcCGA-mw3f-v68m-4g9vCGA-p7hf-43v4-823pCGA-pcp7-p776-p8gjCGA-pp9h-8m4w-4gc3CGA-ppqr-56xf-4w29CGA-pr4f-f698-fmphCGA-q5hg-2vwr-rfwgCGA-qfvp-m72w-2g73CGA-r2w7-245f-c249CGA-r3w9-x688-j66pCGA-r3xg-7c4f-xhxxCGA-r7x7-85hh-mmw6CGA-rc7c-hrc2-jcj5CGA-rmjr-cvf6-x282CGA-v3f3-7786-89p7CGA-vcqf-23ch-2vhwCGA-vgmm-5wv8-j7cvCGA-vmcr-84p3-c7whCGA-vrc7-958r-j5jrCGA-vrp6-rq7p-5h76CGA-w4xh-4rf5-5q5qCGA-w82m-f823-8ccvCGA-whxj-g425-6hw7CGA-wjf5-pwrp-9jxpCGA-wjpr-cf92-wqrfCGA-x34w-5jm3-v688CGA-x4h5-35f7-8hq5
Published 08-07-2026Last modified 08-07-2026
Vulnerability summary
CVE-2026-59874 is a high (CVSS 8.7) Infinite Loop vulnerability in isaacs node-tar. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 36.3% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
8.7/10
010
High · v4.0 (CVE.org)EPSS score
0.43%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Advisory lineage
Upstream 0 · Downstream 9 · Related 1Timeline
- 08-07-2026PublishedVulnerability first disclosed.
- 08-07-2026Last modifiedVulnerability information updated.
Description
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.
CVSS metrics
10 scores · 7 sources · 2 versionsHigh 8.7Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NSourcesAll 6 agree
- OSV · UbuntuEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- OSV · WolfiEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- OSV · NpmEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- OSV · ChainguardEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- NVDNIST8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
High 7.5Preferred score · OSV · Ubuntu (Ecosystem advisory) · calculated from vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 4 agree
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · NpmEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.43%
Chance of exploitation in the next 30 days
Percentile
36%
Versus all other CVEs
30-day change
0.00 pp
From 0.43% on 20-09-2026
20-09-202620-10-2026
EPSS score0.43%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundNode Tar
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Chainguard42 products
- actions-runner< 2.336.0-r1
- code-server< 4.129.0-r1
- gitlab-rails-ce-18.1< 18.1.6-r31
- gitlab-rails-ce-18.10All versions (No fix recorded)
- gitlab-rails-ce-18.6All versions (No fix recorded)
Wolfi10 products
- code-server< 4.129.0-r1
- jupyter-base-notebook< 7.6.3-r2
- kubeflow-centraldashboard< 1.10.0-r25
- lerna< 9.0.7-r11
- npm< 12.0.0-r1
Debian1 product
- node-tarAll versions (No fix recorded) | < 7.5.19+~4.0.1-1
Npm1 product
- tar< 7.5.18
Ubuntu1 product
- node-tarAll versions (No fix recorded)
6 vendors · 57 products
References
9 links- github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5wX Refsource CONFIRMREPORTAdvisoryWEBExploitVendor Advisory
- github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5X Refsource MISCFIXWEBPatch
- github.com/isaacs/node-tarPACKAGE