These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-59875 is a vulnerability in node-tar, a tar archive manipulation library for Node.js. Prior to version 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records, allowing a crafted archive to reach fs.lstat or fs.open and terminate the process with an uncaught exception. This issue affects developers and administrators using node-tar in their applications, who should be aware o [truncated]
CVE-2026-59874 is a denial-of-service vulnerability in the node-tar library's tar.replace function. The issue arises when the function accepts a checksum-valid tar header with a negative base-256 encoded entry size. This causes the archive scanner to repeatedly parse the same header, making no progress. The vulnerability was fixed in version 7.5.18. Affected applications that use node-tar to manipulate ta [truncated]
CVE-2026-59873 is a critical vulnerability in node-tar, a tar archive manipulation library for Node.js. The issue allows a small crafted gzip bomb to exhaust disk space and CPU due to the lack of hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths. This vulnerability was fixed in version 7.5.19. The vulnerability has a CVSS score of 9.2 and is [truncated]
CVE-2026-59871 is a vulnerability in node-tar, a tar archive manipulation library for Node.js. Prior to version 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPath(entry.path).split('/') to throw an uncaught TypeError. This issue is fixed in version 7.5.18. The vulnerability has a CVSS score of 5 [truncated]
CVE-2026-29786 is a high-severity vulnerability in node-tar, a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target such as C:../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This issue has been patched in version 7.5.10. The vulnerabili [truncated]