---
title: "GHSA-w8wr-v893-vjvp: node-tar: Process crash via PAX numeric path type confusion"
description: "Moderate severity. node-tar: Process crash via PAX numeric path type confusion. Affects tar; fixed in 7.5.18."
url: https://inlinr.com/advisories/GHSA-w8wr-v893-vjvp
lang: en
---

[Packages](https://inlinr.com/packages) / [tar](https://inlinr.com/packages/tar) / [Security](https://inlinr.com/packages/tar/security)

Moderate Vulnerability GHSA-w8wr-v893-vjvp CVE-2026-59871 Published 20 Jul 2026

# node-tar: Process crash via PAX numeric path type confusion

Your version 

Affected releases · [tar](https://inlinr.com/packages/tar)

- 7.x 7.0.0 – 7.5.17 Fixed in 7.5.18
- 6.x and older 0.0.1 – 6.2.1 No fix, no longer updated

On 7.x, the newest line:

```
npm install tar@7.5.18
```

Every release on a timeline

7.x 

1. Affected

7.0.0 – 7.5.17  
28 releases
2. Fixed

7.5.18 – 7.5.22  
5 releases, latest

6.x 

1. Affected

6.0.0 – 6.2.1  
24 releases

5.x 

1. Affected

5.0.0 – 5.0.11  
12 releases

4.x 

1. Affected

4.0.0 – 4.4.19  
31 releases

3.x 

1. Affected

3.0.0 – 3.2.3  
22 releases

2.x 

1. Affected

2.0.0 – 2.2.2  
7 releases

1.x 

1. Affected

1.0.0 – 1.0.3  
4 releases

0.x 

1. Affected

0.0.1 – 0.1.20  
21 releases

154 stable releases of tar, oldest to newest, one row per major.

## What happens

Summary

A crafted 2.5KB tar archive crashes any Node.js process that extracts it. The PAX header parser coerces all-digit path values to JavaScript numbers, which causes an uncaught TypeError when downstream code calls `.split('/')` on the numeric value. Error handlers and `strict: false` cannot intercept the crash.

Details

In `pax.ts` line 180, `parseKV` converts PAX values matching `/^[0-9]+$/` to numbers via `+v`. This applies to all fields including `path` and `linkpath`. When a PAX header sets `path` to an all-digit string like `"12345"`, the value becomes the number `12345`.

This number flows through Header -> ReadEntry -> Unpack.CHECKPATH, where `normalizeWindowsPath(entry.path).split('/')` throws a TypeError because numbers don't have `.split()`.

The throw is synchronous during event emission and bypasses all error handling:

- `strict: false` does not help
- `'error'` event handlers do not catch it
- `'warn'` handlers do not catch it
- The TypeError propagates through the event emitter stack as an uncaughtException

Directory, SymbolicLink, and Link type entries reach CHECKPATH and crash. File type entries crash earlier in Header constructor at `this.path.slice(-1)`, but that throw is caught and emitted as a warning only.

PoC

Create a tar archive with a PAX extended header containing an all-digit path:

```
PAX header body: "18 path=12345\n"
Entry type: Directory (type '5')
```

Extract it:

```
const tar = require('tar');

// All of these crash with TypeError: t.split is not a function
tar.extract({ file: 'malicious.tar', cwd: '/tmp/test' });

// Error handlers don't help:
tar.extract({ file: 'malicious.tar', cwd: '/tmp/test', strict: false })
  .on('error', (err) => { /* never reached */ })
  .on('warn', (code, msg) => { /* never reached */ });
```

The archive is \~2.5KB. The crash is deterministic on every attempt.

Impact

Denial of service. Any application or tool that extracts untrusted tar archives crashes from a single small file. This includes npm (which uses node-tar to extract packages), CI/CD pipelines, file upload processors, and backup tools. The crash cannot be caught by application-level error handling.

## How it is exploited

Exploitable over the network, with no account and no action from a user.

- **Confidentiality**: none
- **Integrity**: none
- **Availability**: low

CVSS:3.1/​AV:N/​AC:L/​PR:N/​UI:N/​S:U/​C:N/​I:N/​A:L

## References

- [Reference](https://github.com/isaacs/node-tar/security/advisories/GHSA-w8wr-v893-vjvp "https://github.com/isaacs/node-tar/security/advisories/GHSA-w8wr-v893-vjvp")  
github.com/isaacs/node-tar/security/advisories/…
- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-59871 "https://nvd.nist.gov/vuln/detail/CVE-2026-59871")  
nvd.nist.gov/vuln/detail/CVE-2026-59871
- [Fix commit](https://github.com/isaacs/node-tar/commit/e02a4e9e013c4be95302e2eb2047a942b883c27b "https://github.com/isaacs/node-tar/commit/e02a4e9e013c4be95302e2eb2047a942b883c27b")  
e02a4e9
- [Package](https://github.com/isaacs/node-tar "https://github.com/isaacs/node-tar")  
github.com/isaacs/node-tar
- [Reference](https://github.com/isaacs/node-tar/releases/tag/v7.5.18 "https://github.com/isaacs/node-tar/releases/tag/v7.5.18")  
github.com/isaacs/node-tar/releases/tag/v7.5.18