CVE-2026-59873 critical severity vulnerability in tar@7.5.11 for npm@10.9.8 #9801

Situation

Security scans report a critical severity vulnerability CVE-2026-59873 for tar@7.5.11 in npm@10.9.8 bundled in Node.js 22.23.1

Steps to reproduce

Scan the latest node:22 Docker image with trivy.

trivy image --ignore-unfixed --pkg-types library --scanners vuln --severity CRITICAL node:22.23.1

Background

• Node.js 22.23.1 is the latest Node.js 22.x release

• Node.js 22.x is in status Maintenance LTS until End-of-life on 2027-04-30. The definition of this phase states:

  Maintenance - Critical bug fixes and security updates.

• npm@10.9.8 is the latest npm 10.x release, published on March 27, 2026

• Although npm@11.18.0 already bundles tar@7.5.19, these higher versions of npm are not backported to Node.js 22.x, which remains using npm 10.x.

• tar@7.5.19 resolves CVE-2026-59873

• tar@7.5.22 is latest

Suggestion

• Update tar to >= 7.19.0 for npm 10.x and release with this update.

• Pass the new release to Node.js for bundling into Node.js 22.x