CVE-2026-59874: 
JavaScript vulnerability analysis and mitigation

CVE-2026-59874 is a Denial of Service vulnerability in node-tar, a tar archive manipulation library for Node.js, caused by an infinite loop triggered by a malformed tar header with a negative base-256 encoded entry size. It affects all versions of the tar npm package up to and including 7.5.17, and was fixed in version 7.5.18. The vulnerability was published by isaacs on June 27, 2026, and added to the NVD on July 8, 2026. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High) (Github Advisory, Red Hat Bugzilla).

The root cause is an unchecked input for loop condition (CWE-606) leading to a loop with an unreachable exit condition (CWE-835). The tar.replace() API scans an existing archive by parsing each tar header and advancing the archive position by the parsed entry size rounded to a 512-byte block boundary. Tar's base-256 encoding allows numeric fields to represent negative values; a crafted header can encode the entry size as -512 while still carrying a valid checksum, causing the position-advance calculation to yield zero net progress (-512 body skip + 512 header step = 0), so the scanner repeatedly parses the same header indefinitely. Exploitation requires only that the attacker control the archive file passed to tar.replace() — no extraction, privilege escalation, or uncaught exception is involved. A complete proof-of-concept (poc.mjs) is publicly available in the security advisory (Github Advisory, Patch Commit).

Successful exploitation causes a Node.js worker process to spin indefinitely in a CPU-consuming infinite loop, resulting in a denial of service for any application that calls tar.replace() on an attacker-controlled archive. There is no impact on confidentiality or integrity — the vulnerability is purely an availability issue. Applications relying on archive update workflows (e.g., build pipelines, package managers, or file management services) are most at risk, as a single malicious archive can permanently pin a worker process until it is manually killed or the process manager restarts it (Github Advisory).

1. Craft a malicious tar archive: Create a 512-byte tar header where the size field (bytes 124–135) is base-256 encoded as -512 (e.g., 0xff 0xff 0xff 0xff 0xff 0xff 0xff 0xff 0xff 0xff 0xfe 0x00), with all other fields set to valid values and a correct checksum computed over the full header.
2. Ensure checksum validity: Compute the header checksum by summing all bytes (treating the checksum field as spaces) and writing the result in octal to bytes 148–155. This makes the header pass node-tar's checksum validation.
3. Deliver the archive to the target application: Supply the crafted .tar file to any application that calls tar.replace() on user- or attacker-controlled archives (e.g., via file upload, network share, or a build artifact pipeline).
4. Trigger the infinite loop: When the application calls tar.replace({ file: 'poc.tar', ... }, [...]), the archive scanner parses the malicious header, computes a net position advance of zero (-512 + 512 = 0), and loops forever without reaching the append step.
5. Achieve denial of service: The Node.js worker process is pinned at 100% CPU indefinitely, preventing the application from processing any further archive operations until the process is killed or restarted (Github Advisory).

• Process: A Node.js process (node) consuming sustained 100% CPU for an extended period without completing, particularly one associated with archive processing or a build/package management workflow.
• File System: Presence of a .tar file with a 512-byte header where bytes 124–135 encode a negative value using base-256 encoding (high-bit set, e.g., leading 0xff bytes in the size field); temporary directories matching the pattern tar-loop-* in the system temp directory.
• Logs: Application logs showing a tar.replace() call that never completes or times out (e.g., ETIMEDOUT errors from a wrapper with a timeout); absence of a "completed" log entry following an archive replace operation that was initiated.
• Network: Unexpected or repeated delivery of small (512-byte) .tar files from external sources to services that process archives (Github Advisory).

The primary remediation is to upgrade the tar npm package to version 7.5.18 or later, which refuses to accept a parsed header size less than zero by treating negative values as undefined (Patch Commit, Release v7.5.18). If an immediate upgrade is not possible, implement input validation to reject tar archives with suspicious or malformed headers (e.g., headers where the size field has the high bit set indicating base-256 encoding with a negative value) before passing them to the library. Additionally, avoid calling tar.replace() on archives sourced from untrusted or attacker-controlled inputs until the patch is applied (Github Advisory, Red Hat Bugzilla).

Red Hat tracked the vulnerability as high severity in their Bugzilla system and issued an errata (RHSA-2026:42815), reflecting its relevance to Red Hat products that bundle node-tar (Red Hat Bugzilla). Microsoft also acknowledged the CVE in their update guide. The vulnerability was reported by researcher Jvr2022 and received coverage from automated vulnerability tracking services including Tenable (Nessus plugin 325940) and OSV. Community reaction has been limited given the narrow attack surface (only tar.replace() with attacker-controlled archives), with no significant social media controversy observed.