{"items":[{"id":"NVI-00016088","kind":"vulnerability","title":"node-tar: Process crash via PAX numeric path type confusion","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-w8wr-v893-vjvp","CVE-2026-59871"],"plain_summary":"GitHub lists this reviewed advisory for tar. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-1cbd9a4d85af5fd123d2a6dcf0705fa2"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-07-20T21:53:15.000Z","value":"5.3 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-1cbd9a4d85af5fd123d2a6dcf0705fa2"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-1cbd9a4d85af5fd123d2a6dcf0705fa2","url":"https://github.com/advisories/GHSA-w8wr-v893-vjvp","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-w8wr-v893-vjvp","publisher":"GitHub Advisory Database","observed_at":"2026-11-03T22:35:18.117Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-1cbd9a4d85af5fd123d2a6dcf0705fa2"],"technology":"tar","known_exclusions":[],"conditions_summary":"### Summary\n\nA crafted 2.5KB tar archive crashes any Node.js process that extracts it. The PAX header parser coerces all-digit path values to JavaScript numbers, which causes an uncaught TypeError when downstream code calls `.split('/')` on the numeric value. Error handlers and `strict: false` cannot intercept the crash.\n\n### Details\n\nIn `pax.ts` line 180, `parseKV` converts PAX values matching `/^[0-9]+$/` to numbers via `+v`. This applies to all fields including `path` and `linkpath`. When a PAX header sets `path` to an all-digit string like `\"12345\"`, the value becomes the number `12345`.\n\nThis number flows through Header -> ReadEntry -> Unpack.CHECKPATH, where `normalizeWindowsPath(entry.path).split('/')` throws a TypeError because numbers don't have `.split()`.\n\nThe throw is synchronous during event emission and bypasses all error handling:\n- `strict: false` does not help\n- `'error'` event handlers do not catch it\n- `'warn'` handlers do not catch it\n- The TypeError propagates through the event emitter stack as an uncaughtException\n\nDirectory, SymbolicLink, and Link type entries reach CHECKPATH and crash. File type entries crash earlier in Header constructor at `this.path.slice","public_affected_ranges":["<= 7.5.17"]}],"null_published_at":"2026-11-04T10:04:27.887Z","source_updated_at":"2026-07-20T21:53:15.000Z","source_disclosed_at":"2026-07-20T21:53:14.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-03T22:35:18.117Z"}],"next_cursor":null,"snapshot_revision":"42594"}