CVE-2026-59875CWE-248

node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records

Medium · published July 8, 2026

CVSS v3.1
5.3
EPSS
1%
Percentile
42.3
In the wild
Unconfirmed
What it is

node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.lstat or fs.open and terminate the process with an uncaught exception. This issue is fixed in version 7.5.17.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00507 · 42.3th percentile
Weakness
CWE-248 · Uncaught Exception
Published
2026-07-08T15:20Z
EPSS history
Timeline
  • 08 JUL 15:20Z
    node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records
    cvelistv5