Most recent entries from all

certfr-2026-avi-0958 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

2026-10-02T10:01:13.309465+00:00

certfr-2026-avi-0958

Withdrawn: CLEANSTART-2026-JR64129 — Security fixes in renovate 44.32.4-r1

2026-10-02T10:01:13.309523+00:00

Withdrawn by the publisher.

Affected: CleanStart: renovate

Package renovate version 44.32.4-r1 fixes 27 vulnerabilities: CVE-2026-59873, CVE-2026-59874, CVE-2026-59871, CVE-2026-59875, ghsa-r292-9mhp-454m...

EUVD-2026-334010

2026-10-02T10:01:13.309560+00:00

EUVD-2026-334010

fkie_cve-2026-59871

2026-10-02T10:01:13.309576+00:00

node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPath(entry.path).split('/') to throw an uncaught TypeError. This issue is fixed in version 7.5.18.

GHSA-w8wr-v893-vjvp — node-tar: Process crash via PAX numeric path type confusion

2026-10-02T10:01:13.309601+00:00

Affected: npm: tar

### Summary

A crafted 2.5KB tar archive crashes any Node.js process that extracts it. The PAX header parser coerces all-digit path values to JavaScript numbers, which causes an uncaught TypeError when downstream code calls `.split('/')` on the numeric value. Error handlers and `strict: false` cannot intercept the crash.

### Details

In `pax.ts` line 180, `parseKV` converts PAX values matching `/^[0-9]+$/` to numbers via `+v`. This applies to all fields including `path` and `linkpath`. When a PAX header sets `path` to an all-digit string like `"12345"`, the value becomes the number `12345`.

This number flows through Header -> ReadEntry -> Unpack.CHECKPATH, where `normalizeWindowsPath(entry.path).split('/')` throws a TypeError because numbers don't have `.split()`.

The throw is synchronous during event emission and bypasses all error handling: - `strict: false` does not help - `'error'` event handlers do not catch it - `'warn'` handlers do not catch it - The TypeError propagates through the event emitter stack as an uncaughtException

Directory, SymbolicLink, and Link type entries reach CHECKPATH and crash. File type entries crash earlier in Header constructor at `this.path.slice(-1)`, but that throw is caught and emitted as a warning only.

### PoC

Create a tar archive with a PAX extended header containing an all-digit path:

``` PAX header body: "18 path=12345\n" Entry type: Directory (type '5') ```

Extract it: ```js const tar = require('tar');

// All of these crash w…

msrc_CVE-2026-59871 — node-tar: Process crash via PAX numeric path type confusion

2026-10-02T10:01:13.309651+00:00

msrc_CVE-2026-59871

NCSC-2026-0325 — Kwetsbaarheden verholpen in Atlassian producten

2026-10-02T10:01:13.309670+00:00

NCSC-2026-0325

UBUNTU-CVE-2026-59871

2026-10-02T10:01:13.309865+00:00

Affected: Ubuntu:Pro:14.04:LTS: node-tar, Ubuntu:Pro:16.04:LTS: node-tar, Ubuntu:18.04:LTS: node-tar, Ubuntu:Pro:20.04:LTS: node-tar, Ubuntu:22.04:LTS: node-tar, Ubuntu:24.04:LTS: node-tar, Ubuntu:25.10: node-tar, Ubuntu:26.04:LTS: node-tar

WID-SEC-W-2026-2923 — Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye, und Jira): Mehrere Schwachstellen

2026-10-02T10:01:13.309935+00:00

Ein Angreifer kann mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence, Atlassian Crucible, Atlassian Fisheye und Atlassian Jira ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen, um einen SQL-Injection Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen.