{"schemaVersion":3,"id":"CVE-2026-59874","aliases":["UBUNTU-CVE-2026-59874","DEBIAN-CVE-2026-59874","CGA-299p-7g48-hwxv","CGA-3gc2-pc28-9286","CGA-4jjp-gjfp-f9q3","CGA-4wmw-m24v-c63p","CGA-5pg6-rpf8-w9vh","CGA-5q2c-qmhj-7mmg","CGA-66j4-8mqm-cv9m","CGA-69fm-qhfc-6583","CGA-6g33-pr5x-h7c4","CGA-6m7w-5v9q-rrh6","CGA-756w-x636-r36q","CGA-7933-v5hh-h5m7","CGA-92m5-7ccg-7x2j","CGA-f3hp-28w9-55ww","CGA-frwr-rfhg-fjh4","CGA-fvgq-g5c4-x44x","CGA-g3qm-9rjv-46qh","CGA-gw93-xj28-4c7h","CGA-j524-2wxf-94c9","CGA-j7qp-v7gh-w7c4","CGA-jh5r-w458-x8g6","CGA-jxrc-c7m8-w98j","CGA-mwcj-7r6q-mvp5","CGA-r9fr-vrjw-gmfj","CGA-rgvw-wxr9-wrv8","CGA-rmvh-x9m4-prrp","CGA-v4qx-5ghm-4cj5","CGA-x27m-g72g-g85j","GHSA-8x88-c5mf-7j5w","CGA-243w-jc8g-w7xx","CGA-249f-8gx8-p5fr","CGA-27hf-wx88-pm4f","CGA-28qh-cw34-mwcp","CGA-2hrj-9x38-g52h","CGA-2p75-2358-wr79","CGA-2v5h-fvg8-qcm6","CGA-2vvg-4x2r-xgqc","CGA-2x4q-ph79-9qgg","CGA-33f2-gw92-hqcm","CGA-3766-jgjc-9w2r","CGA-3m3x-3mw8-c576","CGA-3vmr-qgcw-h7wr","CGA-42jh-5wx9-5p99","CGA-42wr-gh6p-prqf","CGA-45rc-v95g-2m94","CGA-46j8-g92h-3cqx","CGA-4cxf-qj7r-fjw7","CGA-4p7h-j6vv-pqcf","CGA-4qq3-85qm-32p2","CGA-5875-w36m-gg3h","CGA-5h3c-gw68-hh32","CGA-5j35-5mf5-pjhx","CGA-5pcp-h5w5-6fmr","CGA-5rc2-g46m-8wvj","CGA-6hw9-6q78-mh6w","CGA-6p7m-6vjr-8224","CGA-6w27-w2f5-r79g","CGA-6xhr-cf73-8pm2","CGA-72vp-jm2q-7w2p","CGA-7g8p-pq45-x884","CGA-7qmc-42vj-mqj6","CGA-7rxm-c5jx-wmq2","CGA-7xjg-737v-v6ww","CGA-8989-9xw5-22vv","CGA-89m6-hmpv-xr93","CGA-8fpc-m75q-pgvj","CGA-8jx6-6g37-ccfw","CGA-8pjw-f96j-q9v3","CGA-8r9p-mwqv-vgp2","CGA-8rc8-mxwg-mjv2","CGA-8ww7-j32f-h8x5","CGA-8xmr-5whv-q9q4","CGA-9mj9-q9hr-pq36","CGA-9mvg-8mpm-2m7m","CGA-c49c-8mmj-c238","CGA-c52g-9jg2-9x2m","CGA-cgq5-wg35-h257","CGA-chq8-v8ph-r6v3","CGA-f4x9-8x7f-58pw","CGA-f873-499q-2mwx","CGA-ffvp-pmvg-q886","CGA-fj6f-7cq9-g4x9","CGA-fmhr-p5jh-mm8q","CGA-fp2v-gw2q-jcg2","CGA-fq9h-3mfv-2hgm","CGA-fqmv-7f24-q9xq","CGA-gmrw-j6qv-g296","CGA-gv52-wmxx-qgq5","CGA-hf59-4rxv-8wq8","CGA-hjm9-9wvw-7gpg","CGA-hw3x-8jmx-jq3x","CGA-j63q-cf5p-3w4c","CGA-m2xc-94m4-w826","CGA-m69c-6mrw-88r7","CGA-m932-wcr9-v436","CGA-mf6f-vfm4-pq3h","CGA-mj96-qcj4-g733","CGA-mrmm-qg4p-274g","CGA-mvx4-rv9f-mpvc","CGA-mw3f-v68m-4g9v","CGA-p7hf-43v4-823p","CGA-pcp7-p776-p8gj","CGA-pp9h-8m4w-4gc3","CGA-ppqr-56xf-4w29","CGA-pr4f-f698-fmph","CGA-q5hg-2vwr-rfwg","CGA-qfvp-m72w-2g73","CGA-r2w7-245f-c249","CGA-r3w9-x688-j66p","CGA-r3xg-7c4f-xhxx","CGA-r7x7-85hh-mmw6","CGA-rc7c-hrc2-jcj5","CGA-rmjr-cvf6-x282","CGA-v3f3-7786-89p7","CGA-vcqf-23ch-2vhw","CGA-vgmm-5wv8-j7cv","CGA-vmcr-84p3-c7wh","CGA-vrc7-958r-j5jr","CGA-vrp6-rq7p-5h76","CGA-w4xh-4rf5-5q5q","CGA-w82m-f823-8ccv","CGA-whxj-g425-6hw7","CGA-wjf5-pwrp-9jxp","CGA-wjpr-cf92-wqrf","CGA-x34w-5jm3-v688","CGA-x4h5-35f7-8hq5"],"status":"published","duplicateOf":null,"title":null,"description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.","dates":{"published":"2026-07-08T15:23:47.527Z","modified":"2026-07-08T17:00:42.937Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":8.7,"severity":"high","version":"4.0","versionLabel":"v4.0","source":"CVE.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"4.0","versionLabel":"v4.0","source":"CVE.org","score":8.7,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Ubuntu","score":8.7,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":10,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":10,"impact":6,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Wolfi","score":8.7,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Npm","score":8.7,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Npm","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":10,"impact":6,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Chainguard","score":8.7,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"NVD","score":8.7,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00434,"percentile":0.3635,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.00434},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00434,"percentile":0.3635}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00644,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00434,"percentile":0.3635}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"GITHUB_ISAACS_NODE-TAR","name":"Node Tar","source":"github","url":"https://github.com/isaacs/node-tar/security/advisories/GHSA-f5x3-32g6-xq36","maturity":"poc","reliabilityScore":0.3,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-835","name":"Loop with Unreachable Exit Condition ('Infinite Loop')","description":"The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/835.html"}],"affected":[{"vendor":"chainguard","product":"actions-runner","name":"actions-runner","label":"actions-runner","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/actions-runner","purlType":"apk","versions":[{"text":"< 2.336.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.336.0-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"code-server","name":"code-server","label":"code-server","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/code-server","purlType":"apk","versions":[{"text":"< 4.129.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.129.0-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.1","name":"gitlab-rails-ce-18.1","label":"gitlab-rails-ce-18.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.1","purlType":"apk","versions":[{"text":"< 18.1.6-r31","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.1.6-r31","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.10","name":"gitlab-rails-ce-18.10","label":"gitlab-rails-ce-18.10","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.10","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.6","name":"gitlab-rails-ce-18.6","label":"gitlab-rails-ce-18.6","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.6","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.7","name":"gitlab-rails-ce-18.7","label":"gitlab-rails-ce-18.7","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.7","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.8","name":"gitlab-rails-ce-18.8","label":"gitlab-rails-ce-18.8","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.8","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.9","name":"gitlab-rails-ce-18.9","label":"gitlab-rails-ce-18.9","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.9","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-19.0","name":"gitlab-rails-ce-19.0","label":"gitlab-rails-ce-19.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-19.0","purlType":"apk","versions":[{"text":"< 19.0.4-r10","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.0.4-r10","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-19.1","name":"gitlab-rails-ce-19.1","label":"gitlab-rails-ce-19.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-19.1","purlType":"apk","versions":[{"text":"< 19.1.2-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.1.2-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-19.2","name":"gitlab-rails-ce-19.2","label":"gitlab-rails-ce-19.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-19.2","purlType":"apk","versions":[{"text":"< 19.2.2-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.2.2-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.1","name":"gitlab-rails-ce-fips-18.1","label":"gitlab-rails-ce-fips-18.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.1","purlType":"apk","versions":[{"text":"< 18.1.6-r61","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.1.6-r61","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.10","name":"gitlab-rails-ce-fips-18.10","label":"gitlab-rails-ce-fips-18.10","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.10","purlType":"apk","versions":[{"text":"< 18.10.8-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.10.8-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.11","name":"gitlab-rails-ce-fips-18.11","label":"gitlab-rails-ce-fips-18.11","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.11","purlType":"apk","versions":[{"text":"< 18.11.12-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.11.12-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.6","name":"gitlab-rails-ce-fips-18.6","label":"gitlab-rails-ce-fips-18.6","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.6","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.7","name":"gitlab-rails-ce-fips-18.7","label":"gitlab-rails-ce-fips-18.7","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.7","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.8","name":"gitlab-rails-ce-fips-18.8","label":"gitlab-rails-ce-fips-18.8","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.8","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.9","name":"gitlab-rails-ce-fips-18.9","label":"gitlab-rails-ce-fips-18.9","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.9","purlType":"apk","versions":[{"text":"< 18.9.8-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.9.8-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-19.0","name":"gitlab-rails-ce-fips-19.0","label":"gitlab-rails-ce-fips-19.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-19.0","purlType":"apk","versions":[{"text":"< 19.0.4-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.0.4-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-19.1","name":"gitlab-rails-ce-fips-19.1","label":"gitlab-rails-ce-fips-19.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-19.1","purlType":"apk","versions":[{"text":"< 19.1.2-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.1.2-r9","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-19.2","name":"gitlab-rails-ce-fips-19.2","label":"gitlab-rails-ce-fips-19.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-19.2","purlType":"apk","versions":[{"text":"< 19.2.1-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.2.1-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"graalvm-25-ce-nodejs","name":"graalvm-25-ce-nodejs","label":"graalvm-25-ce-nodejs","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/graalvm-25-ce-nodejs","purlType":"apk","versions":[{"text":"< 25.0.4-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 25.0.4-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"homepage","name":"homepage","label":"homepage","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/homepage","purlType":"apk","versions":[{"text":"< 1.13.2-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.13.2-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jupyter-base-notebook","name":"jupyter-base-notebook","label":"jupyter-base-notebook","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jupyter-base-notebook","purlType":"apk","versions":[{"text":"< 7.6.3-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.6.3-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.0","name":"kibana-9.0","label":"kibana-9.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.0","purlType":"apk","versions":[{"text":"< 9.0.8-r34","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.0.8-r34","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.0-bitnami","name":"kibana-9.0-bitnami","label":"kibana-9.0-bitnami","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.0-bitnami","purlType":"apk","versions":[{"text":"< 9.0.8-r34","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.0.8-r34","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.0-iamguarded","name":"kibana-9.0-iamguarded","label":"kibana-9.0-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.0-iamguarded","purlType":"apk","versions":[{"text":"< 9.0.8-r34","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.0.8-r34","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.2","name":"kibana-9.2","label":"kibana-9.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.2","purlType":"apk","versions":[{"text":"< 9.2.8-r17","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.2.8-r17","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.2-iamguarded","name":"kibana-9.2-iamguarded","label":"kibana-9.2-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.2-iamguarded","purlType":"apk","versions":[{"text":"< 9.2.8-r17","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.2.8-r17","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kubeflow-centraldashboard","name":"kubeflow-centraldashboard","label":"kubeflow-centraldashboard","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kubeflow-centraldashboard","purlType":"apk","versions":[{"text":"< 1.10.0-r25","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.10.0-r25","eol":null,"hubHref":null},{"vendor":"chainguard","product":"lerna","name":"lerna","label":"lerna","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/lerna","purlType":"apk","versions":[{"text":"< 9.0.7-r11","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.0.7-r11","eol":null,"hubHref":null},{"vendor":"chainguard","product":"npm","name":"npm","label":"npm","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/npm","purlType":"apk","versions":[{"text":"< 12.0.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 12.0.0-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-dashboards-2","name":"opensearch-dashboards-2","label":"opensearch-dashboards-2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-dashboards-2","purlType":"apk","versions":[{"text":"< 2.19.6-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.6-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-dashboards-2-fips","name":"opensearch-dashboards-2-fips","label":"opensearch-dashboards-2-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-dashboards-2-fips","purlType":"apk","versions":[{"text":"< 2.19.5-r18","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.5-r18","eol":null,"hubHref":null},{"vendor":"chainguard","product":"pnpm-stage0","name":"pnpm-stage0","label":"pnpm-stage0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/pnpm-stage0","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"prism","name":"prism","label":"prism","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/prism","purlType":"apk","versions":[{"text":"< 5.16.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.16.0-r1","eol":{"isEol":null,"eolDate":null,"matchMethod":"alias_exact","cycle":null,"product":{"name":"nutanix-prism","label":"Nutanix Prism Central","category":"server-app"}},"hubHref":null},{"vendor":"chainguard","product":"pulumi-language-nodejs","name":"pulumi-language-nodejs","label":"pulumi-language-nodejs","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/pulumi-language-nodejs","purlType":"apk","versions":[{"text":"< 3.253.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.253.0-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"saf","name":"saf","label":"saf","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/saf","purlType":"apk","versions":[{"text":"< 1.6.0-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.6.0-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"sqlpad","name":"sqlpad","label":"sqlpad","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/sqlpad","purlType":"apk","versions":[{"text":"< 7.5.7-r29","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.5.7-r29","eol":null,"hubHref":null},{"vendor":"chainguard","product":"tensorflow-gpu-jupyter","name":"tensorflow-gpu-jupyter","label":"tensorflow-gpu-jupyter","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/tensorflow-gpu-jupyter","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard","name":"wazuh-dashboard","label":"wazuh-dashboard","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard","purlType":"apk","versions":[{"text":"< 4.14.6-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.6-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-fips","name":"wazuh-dashboard-fips","label":"wazuh-dashboard-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-fips","purlType":"apk","versions":[{"text":"< 4.14.6-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.6-r4","eol":null,"hubHref":null},{"vendor":"wolfi","product":"code-server","name":"code-server","label":"code-server","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/code-server","purlType":"apk","versions":[{"text":"< 4.129.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.129.0-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"jupyter-base-notebook","name":"jupyter-base-notebook","label":"jupyter-base-notebook","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/jupyter-base-notebook","purlType":"apk","versions":[{"text":"< 7.6.3-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.6.3-r2","eol":null,"hubHref":null},{"vendor":"wolfi","product":"kubeflow-centraldashboard","name":"kubeflow-centraldashboard","label":"kubeflow-centraldashboard","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/kubeflow-centraldashboard","purlType":"apk","versions":[{"text":"< 1.10.0-r25","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.10.0-r25","eol":null,"hubHref":null},{"vendor":"wolfi","product":"lerna","name":"lerna","label":"lerna","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/lerna","purlType":"apk","versions":[{"text":"< 9.0.7-r11","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.0.7-r11","eol":null,"hubHref":null},{"vendor":"wolfi","product":"npm","name":"npm","label":"npm","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/npm","purlType":"apk","versions":[{"text":"< 12.0.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 12.0.0-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"pnpm-stage0","name":"pnpm-stage0","label":"pnpm-stage0","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/pnpm-stage0","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"wolfi","product":"prism","name":"prism","label":"prism","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/prism","purlType":"apk","versions":[{"text":"< 5.16.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.16.0-r1","eol":{"isEol":null,"eolDate":null,"matchMethod":"alias_exact","cycle":null,"product":{"name":"nutanix-prism","label":"Nutanix Prism Central","category":"server-app"}},"hubHref":null},{"vendor":"wolfi","product":"pulumi-language-nodejs","name":"pulumi-language-nodejs","label":"pulumi-language-nodejs","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/pulumi-language-nodejs","purlType":"apk","versions":[{"text":"< 3.253.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.253.0-r2","eol":null,"hubHref":null},{"vendor":"wolfi","product":"saf","name":"saf","label":"saf","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/saf","purlType":"apk","versions":[{"text":"< 1.6.0-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.6.0-r3","eol":null,"hubHref":null},{"vendor":"wolfi","product":"sqlpad","name":"sqlpad","label":"sqlpad","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/sqlpad","purlType":"apk","versions":[{"text":"< 7.5.7-r29","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.5.7-r29","eol":null,"hubHref":null},{"vendor":"debian","product":"node-tar","name":"node-tar","label":"node-tar","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/node-tar","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 7.5.19+~4.0.1-1","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 7.5.19+~4.0.1-1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"node-tar","name":"node-tar","label":"node-tar","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/node-tar","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"isaacs","product":"node-tar","name":"node-tar","label":"node-tar","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 7.5.18","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.5.18","eol":null,"hubHref":"/vendor/isaacs/node-tar"},{"vendor":"isaacs","product":"tar","name":"tar","label":"tar","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 7.5.18","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.5.18","eol":null,"hubHref":"/vendor/isaacs/tar"},{"vendor":"Npm","product":"tar","name":"tar","label":"tar","ecosystem":"Npm","cpePart":null,"purl":"pkg:npm/tar","purlType":"npm","versions":[{"text":"< 7.5.18","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.5.18","eol":null,"hubHref":null}],"affectedCount":57,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w","label":"github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w","hostname":"github.com","tags":["X Refsource CONFIRM","REPORT","Advisory","WEB","Exploit","Vendor Advisory"]},{"url":"https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5","label":"github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5","hostname":"github.com","tags":["X Refsource MISC","FIX","WEB","Patch"]},{"url":"https://github.com/isaacs/node-tar/releases/tag/v7.5.18","label":"github.com/isaacs/node-tar/releases/tag/v7.5.18","hostname":"github.com","tags":["X Refsource MISC","WEB","Release Notes"]},{"url":"https://ubuntu.com/security/CVE-2026-59874","label":"ubuntu.com/security/CVE-2026-59874","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59874","label":"www.cve.org/CVERecord?id=CVE-2026-59874","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-59874","label":"security-tracker.debian.org/tracker/CVE-2026-59874","hostname":"security-tracker.debian.org","tags":["Advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59874.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59874.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59874","label":"nvd.nist.gov/vuln/detail/CVE-2026-59874","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/isaacs/node-tar","label":"github.com/isaacs/node-tar","hostname":"github.com","tags":["PACKAGE"]}],"lineage":{"upstream":[],"downstream":["RHSA-2026:47057","RHSA-2026:47058","RHSA-2026:47059","RHSA-2026:47060","RHSA-2026:48033","RHSA-2026:48034","RHSA-2026:52399","RHSA-2026:53298","RHSA-2026:57590"],"duplicates":[],"related":["CGA-J2RG-885F-2X3R"]},"timeline":[{"kind":"published","date":"2026-07-08T15:23:47.527Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-07-08T17:00:42.937Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":45,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T23:49:43.154Z","stale":false,"partial":false}}