CVE-2026-59873 critical severity vulnerability in tar@7.5.11 for npm@10.9.8

[MikeMcC399]

Situation

Security scans report a critical severity vulnerability CVE-2026-59873 for tar@7.5.11 in npm@10.9.8 bundled in Node.js 22.23.1

Steps to reproduce

Scan the latest node:22 Docker image with trivy.

trivy image --ignore-unfixed --pkg-types library --scanners vuln --severity CRITICAL node:22.23.1

Background

• Node.js 22.23.1 is the latest Node.js 22.x release

• Node.js 22.x is in status Maintenance LTS until End-of-life on 2027-04-30. The definition of this phase states:

  Maintenance - Critical bug fixes and security updates.

• npm@10.9.8 is the latest npm 10.x release, published on March 27, 2026

• Although npm@11.18.0 already bundles tar@7.5.19, these higher versions of npm are not backported to Node.js 22.x, which remains using npm 10.x.

• tar@7.5.19 resolves CVE-2026-59873

• tar@7.5.22 is latest

Suggestion

• Update tar to >= 7.19.0 for npm 10.x and release with this update.

• Pass the new release to Node.js for bundling into Node.js 22.x

[martinrrm]

Fixed with #9814

[MikeMcC399]

@martinrrm

Is your team opening a PR in https://github.com/nodejs/node to get npm@10.9.9 bundled into Node.js 22.x?

[MikeMcC399]

Updated and re-posted to #9824 for visibility.

[MikeMcC399]

Fix released in npm@10.9.9
nodejs/node#64884 pushes to Node.js 22.x for bundled release