Repository navigation
CVE-2026-59873 critical severity vulnerability in tar@7.5.11 for npm@10.9.8 in Node.js 22.23.2 #9824
Description
Situation
-
Security scans report a critical severity vulnerability CVE-2026-59873 for tar@7.5.11 in npm@10.9.8 bundled in the security update Node.js 22.23.2, released July 29. 2029.
-
npm@10.9.9 is the latest npm 10.x release, published on July 29, 2026. It updates to tar@7.5.22, remediating the vulnerability CVE-2026-59873 for tar@7.5.11
-
npm@10.9.9 is not present in any PR or the v22.x-staging branch in the repo nodejs/node to upgrade Node.js 22.x to this version of npm.
Steps to reproduce
Scan the latest node:22 Docker image with trivy.
trivy image --ignore-unfixed --pkg-types library --scanners vuln --severity CRITICAL node:22.23.2Background
-
Node.js 22.23.2 is the latest Node.js 22.x release
-
Node.js 22.x is in status Maintenance LTS until End-of-life on 2027-04-30. The definition of this phase states:
Maintenance - Critical bug fixes and security updates.
Suggestion
- Pass npm@10.9.9 to Node.js for bundling into Node.js 22.x
Activity
ggioshvili commentedon Jul 31, 2026
Wiz is now reporting this a a Critical issue for every NPM CLI installation including the latest 26.5.1. While it is probably a false positive, it looks really bad and there's no way to upgrade it to a newer tar version.
MikeMcC399 commentedon Jul 31, 2026
@ggioshvili
This issue is for Node.js 22.23.2 with npm@10.9.8 only.
Node.js 26.5.1 has npm@11.17.0 bundled
You can update to npm@11.18.0 with
ggioshvili commentedon Jul 31, 2026
MikeMcC399 commentedon Aug 1, 2026
From the standpoint of npm, this issue is resolved through nodejs/node#64884.
The next steps have to be carried out by Node.js
aliceshi-aaaaaokkk commentedon Aug 3, 2026
tar (package.json) │ GHSA-r292-9mhp-454m │ MEDIUM │ │ 7.5.19 │ 7.5.21
This issue is for npm all versions.......
MikeMcC399 commentedon Aug 3, 2026
@aliceshi-aaaaaokkk
This issue is closed, and the vulnerability you refer to is a different one.
It is not CVE-2026-59873 (GHSA-23hp-3jrh-7fpw).
MikeMcC399 commentedon Aug 3, 2026
@aliceshi-aaaaaokkk
Note also the advice in the bug reporting template, which says:
This is not just a request to bump a dependency for a CVE
npm bundles its dependencies and updates them on a regular cadence, so CVEs in our bundled dependencies are picked up automatically. Issues opened solely to request a dependency bump for a CVE will be closed.
So your new issues go against this advice and you should probably close the issues, and just wait for the updates to happen automatically.
The issue here was not about bumping dependencies, it was about providing an existing release to Node.js.