Name: CVE-2026-59874: Loop with Unreachable Exit Condition
Creator: Rapid7
Published: 2026-07-08T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2026-59874, CWE-835, CVSS 7.5, EPSS 0.00434

node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.

CVSS Details

CVSS 4.0 Base Score: 8.7 (HIGH)
CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
CVSS 3.1 Base Score: 7.5
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Alma_linux	—	Upgrade v8-13.6-develUpgrade nodejs-develUpgrade npmUpgrade v8-12.4-develUpgrade nodejs-nodemonUpgrade nodejs-packaging-bundlerUpgrade nodejsUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejs-docs	Jul 30, 2026	Jul 28, 2026
Amazon_linux_2023	—	Upgrade v8-12.4-develUpgrade nodejs22-npmUpgrade nodejs24-full-i18nUpgrade nodejs22-full-i18nUpgrade nodejs24-docsUpgrade nodejs24-debugsourceUpgrade nodejs22Upgrade nodejs22-docsUpgrade nodejs24Upgrade nodejs22-debuginfoUpgrade nodejs22-debugsourceUpgrade nodejs24-libs-debuginfoUpgrade nodejs22-develUpgrade v8-13.6-develUpgrade nodejs24-develUpgrade nodejs24-libsUpgrade nodejs22-libs-debuginfoUpgrade nodejs24-debuginfoUpgrade nodejs22-libsUpgrade nodejs24-npm	Aug 18, 2026	Jul 8, 2026
Atlassian Jira	—	Upgrade to the latest version of Atlassian JIRA	Aug 19, 2026	Aug 18, 2026
Redhat_linux	—	Upgrade nodejs-debugsourceUpgrade npmUpgrade nodejs-packagingUpgrade v8-12.4-develUpgrade nodejs24-develUpgrade nodejs-full-i18nUpgrade nodejs24-docsUpgrade nodejs-packaging-bundlerUpgrade nodejs24-full-i18nUpgrade nodejsUpgrade nodejs22-debugsourceUpgrade nodejs24-libsUpgrade nodejs24-libs-debuginfoNo solution existsUpgrade nodejs-debuginfoUpgrade v8-13.6-develUpgrade rh-podman-desktopUpgrade nodejs22-debuginfoUpgrade nodejs24-npmUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejs24-debugsourceUpgrade nodejs24-debuginfoUpgrade nodejs-libs-debuginfoUpgrade nodejs-libsUpgrade nodejs24Upgrade nodejs-npm	Jul 17, 2026	Jul 8, 2026
Rocky_linux	—	Upgrade nodejs24-debuginfoUpgrade nodejs22-debugsourceUpgrade v8-12.4-develUpgrade nodejs-develUpgrade nodejs24Upgrade nodejs-libs-debuginfoUpgrade v8-13.6-develUpgrade nodejs24-libsUpgrade nodejs-debuginfoUpgrade npmUpgrade nodejs24-full-i18nUpgrade nodejs24-libs-debuginfoUpgrade nodejsUpgrade nodejs24-debugsourceUpgrade nodejs-full-i18nUpgrade nodejs24-develUpgrade nodejs-npmUpgrade nodejs-debugsourceUpgrade nodejs-libsUpgrade nodejs22-debuginfo	Jul 31, 2026	Jul 28, 2026

Prioritise with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritise with Active Threat Intelligence