CVE-2026-59875: 
JavaScript vulnerability analysis and mitigation

CVE-2026-59875 is a Denial of Service vulnerability in node-tar, a tar archive manipulation library for Node.js, caused by improper handling of NUL bytes in PAX extended header records. All versions up to and including 7.5.16 (npm package tar) are affected. The vulnerability was published on June 25, 2026 (GitHub advisory) and by NVD on July 8, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) (Github Advisory, Red Hat).

The root cause is improper null termination (CWE-170) and uncaught exception handling (CWE-248) in src/pax.ts. The parseKVLine function parses PAX extended header key-value records and assigns the value v directly to the result object without stripping embedded NUL bytes — unlike the equivalent GNU long-header path in src/parse.ts, which already applies .replace(/\0.*/, ''). A crafted PAX record such as path=visible.txt\x00hidden.txt flows verbatim into entry.path, which is then passed to fs.lstat() or fs.open(). Node.js core rejects paths containing NUL bytes with ERR_INVALID_ARG_VALUE, but this throw originates inside an FSReqCallback async chain outside the user's await/try-catch boundary, surfacing as an uncaughtException that terminates the process. A secondary parser-differential issue (CWE-436) exists: GNU tar, bsdtar, and Python's tarfile truncate paths at the first NUL, so a pre-flight validator using those tools will see a benign filename while the subsequent node-tar extraction crashes (Github Advisory, Patch Commit).

Exploitation results in a process-terminating uncaught exception, providing a reliable remote denial-of-service primitive against any Node.js service that processes attacker-supplied tarballs via tar.x, tar.extract, tar.t, or tar.Parser. A single malicious tarball kills the worker process regardless of whether the consumer implements the documented try/catch error-handling pattern, and the process may not respawn if it dies during boot. There is no confidentiality or integrity impact; the vulnerability is limited to availability. Affected deployment contexts include npm registry mirrors, GitHub Actions cache restore pipelines, container image build systems, backup/restore services accepting user uploads, and cloud functions that auto-extract archives (Github Advisory).

1. Craft a malicious tarball: Use the published Python 3 PoC script (poc1-pax-prefix.py) to generate a tarball containing a PAX extended header with a NUL-embedded path, e.g., path=visible.txt\x00hidden.txt. The script requires no external dependencies and produces a ~3 KB .tar file.
2. Identify a target service: Locate a Node.js application that accepts user-supplied tar archives and processes them with node-tar version ≤ 7.5.16 (e.g., a file upload endpoint, npm mirror, CI artifact processor, or cloud function).
3. Bypass pre-flight validation (if present): If the target uses GNU tar, bsdtar, or Python's tarfile to validate archives before extraction, the malicious path will appear benign (truncated to visible.txt) due to the parser-differential behavior, allowing the crafted archive to pass validation.
4. Submit the malicious archive: Upload or deliver the crafted tarball to the target service's archive ingestion endpoint.
5. Trigger process crash: When the service calls tar.x() or equivalent, the NUL-bearing path reaches fs.lstat() or fs.open(), Node.js throws ERR_INVALID_ARG_VALUE inside an async callback, the exception bypasses the consumer's try/catch, and the Node.js process terminates with an uncaughtException — achieving denial of service (Github Advisory).

• Logs: Node.js process logs or stderr showing uncaughtException with error code ERR_INVALID_ARG_VALUE and message containing 'path' must be a string, Uint8Array, or URL without null bytes along with a path containing \x00; unexpected process exit with code 99 or similar non-zero exit.
• Network: Inbound HTTP requests delivering tar archives to upload or extraction endpoints, particularly from unexpected or anonymous sources; repeated requests to the same endpoint in a short window (crash-loop amplification).
• File System: Presence of small (~3 KB) .tar files in upload or temporary directories containing PAX headers (typeflag x) with NUL bytes in path or linkpath fields; files named poc.tar, poc-null-byte-crash.tar, or poc-null-linkpath-crash.tar.
• Process: Unexpected termination and respawn of Node.js worker processes; supervisor logs (e.g., PM2, systemd) showing repeated restarts of the Node.js service (Github Advisory).

Upgrade the tar npm package to version 7.5.17 or later, which applies a one-line fix in src/pax.ts changing kv.join('=') to kv.join('=').replace(/\0.*$/, '') to strip NUL bytes from PAX record values before they reach filesystem APIs (Patch Commit, Release v7.5.17). As a workaround where immediate upgrade is not possible, implement input validation to scan and reject tar archives containing PAX headers with NUL bytes in path or linkpath fields before passing them to node-tar. Additionally, ensure Node.js services have a process supervisor (e.g., PM2, systemd) configured to automatically restart on crash to reduce availability impact during the window before patching.

Red Hat tracked the vulnerability as medium severity in Bugzilla (Bug 2498115) with a broad CC list of 118 users, indicating significant downstream impact across Red Hat products that bundle node-tar (Red Hat Bugzilla). Microsoft also acknowledged the vulnerability in their update guide (MSRC). Tenable published a Nessus detection plugin (ID 325935) shortly after disclosure, enabling automated scanning for vulnerable installations.