https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T14:07:47.860308+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2026-avi-0958 certfr-2026-avi-0958 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-03T14:07:47.954400+00:00 certfr-2026-avi-0958 https://cve.radiocsirt.org/vuln/cleanstart-2026-jr64129 Withdrawn: CLEANSTART-2026-JR64129 — Security fixes in renovate 44.32.4-r1 2026-10-03T14:07:47.954442+00:00

Withdrawn by the publisher.

Affected: CleanStart: renovate

Package renovate version 44.32.4-r1 fixes 27 vulnerabilities: CVE-2026-59873, CVE-2026-59874, CVE-2026-59871, CVE-2026-59875, ghsa-r292-9mhp-454m...

 https://cve.radiocsirt.org/vuln/euvd-2026-335279 EUVD-2026-335279 2026-10-03T14:07:47.954474+00:00 EUVD-2026-335279 https://cve.radiocsirt.org/vuln/fkie_cve-2026-59875 fkie_cve-2026-59875 2026-10-03T14:07:47.954488+00:00

node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.lstat or fs.open and terminate the process with an uncaught exception. This issue is fixed in version 7.5.17.

 https://cve.radiocsirt.org/vuln/ghsa-gvwx-54wh-qm9j GHSA-gvwx-54wh-qm9j — node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records 2026-10-03T14:07:47.954511+00:00

Affected: npm: tar

## Summary

`node-tar` strips trailing `NUL` bytes from long-name (`L`) and long-linkpath (`K`) GNU extended headers but does **not** apply the same sanitization to equivalent fields delivered via PAX (`x` typeflag) extended headers. A PAX record of the form `path=visible.txt\x00hidden.txt` is parsed verbatim into `entry.path` and flows into `fs.lstat()` / `fs.open()`, which Node.js core rejects with `ERR_INVALID_ARG_VALUE`. The throw originates inside an `FSReqCallback` async chain that is **not** wrapped by the consumer's `await/try-catch` around `tar.x()` — it surfaces as `uncaughtException` and terminates the process.

This is a remote denial-of-service primitive against any process that extracts attacker-supplied tarballs through `tar.x` / `tar.extract` / `tar.t` / `tar.Parser`, even when the consumer follows the documented `try/catch` error-handling pattern.

A secondary parser-differential (CWE-436) exists because `tar(1)`, `bsdtar`, and Python `tarfile` truncate the path at the first `NUL` (yielding `visible.txt`) while node-tar retains the full string. A validator that pre-scans a tarball with one tool and extracts with the other is bypassed.

---

## Root cause

### Vulnerable sink — `src/pax.ts:157-183`

PAX KV records flow through `parseKVLine`. The value half (`v`) is assigned directly to the result object with no sanitization for embedded NUL bytes:

```ts // src/pax.ts:157 const parseKVLine = (set: Record<string, unknown>, line: string) => { const n = parseI…

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-59875 msrc_CVE-2026-59875 — node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records 2026-10-03T14:07:47.954590+00:00 msrc_CVE-2026-59875 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-59875 UBUNTU-CVE-2026-59875 2026-10-03T14:07:47.954607+00:00

Affected: Ubuntu:Pro:14.04:LTS: node-tar, Ubuntu:Pro:16.04:LTS: node-tar, Ubuntu:18.04:LTS: node-tar, Ubuntu:Pro:20.04:LTS: node-tar, Ubuntu:22.04:LTS: node-tar, Ubuntu:24.04:LTS: node-tar, Ubuntu:25.10: node-tar, Ubuntu:26.04:LTS: node-tar

node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.lstat or fs.open and terminate the process with an uncaught exception. This issue is fixed in version 7.5.17.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3621 WID-SEC-W-2026-3621 — IBM App Connect Enterprise: Mehrere Schwachstellen 2026-10-03T14:07:47.954637+00:00

Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Informationen offenzulegen, um einen Denial of Service Angriff durchzuführen, um Daten zu manipulieren und um Sicherheitsvorkehrungen zu umgehen.