CVE-2026-59873 critical severity vulnerability in tar@7.5.11 for npm@10.9.8 in Node.js 22.23.2

[MikeMcC399]

• follows on from CVE-2026-59873 critical severity vulnerability in tar@7.5.11 for npm@10.9.8 #9801

Situation

• Security scans report a critical severity vulnerability CVE-2026-59873 for tar@7.5.11 in npm@10.9.8 bundled in the security update Node.js 22.23.2, released July 29. 2029.

• npm@10.9.9 is the latest npm 10.x release, published on July 29, 2026. It updates to tar@7.5.22, remediating the vulnerability CVE-2026-59873 for tar@7.5.11

• npm@10.9.9 is not present in any PR or the v22.x-staging branch in the repo nodejs/node to upgrade Node.js 22.x to this version of npm.

Steps to reproduce

Scan the latest node:22 Docker image with trivy.

trivy image --ignore-unfixed --pkg-types library --scanners vuln --severity CRITICAL node:22.23.2

Background

• Node.js 22.23.2 is the latest Node.js 22.x release

• Node.js 22.x is in status Maintenance LTS until End-of-life on 2027-04-30. The definition of this phase states:

  Maintenance - Critical bug fixes and security updates.

Suggestion

• Pass npm@10.9.9 to Node.js for bundling into Node.js 22.x

[ggioshvili]

Wiz is now reporting this a a Critical issue for every NPM CLI installation including the latest 26.5.1. While it is probably a false positive, it looks really bad and there's no way to upgrade it to a newer tar version.

[MikeMcC399]

@ggioshvili

Wiz is now reporting this a a Critical issue for every NPM CLI installation including the latest 26.5.1. While it is probably a false positive, it looks really bad and there's no way to upgrade it to a newer tar version.

This issue is for Node.js 22.23.2 with npm@10.9.8 only.

Node.js 26.5.1 has npm@11.17.0 bundled

You can update to npm@11.18.0 with

npm install -g npm@11

[ggioshvili]

Thank you!

…

On Fri, Jul 31, 2026 at 2:13 PM Mike McCready ***@***.***> wrote: *MikeMcC399* left a comment (npm/cli#9824) <#9824 (comment)> @ggioshvili <https://github.com/ggioshvili> Wiz is now reporting this a a *Critical* issue for every NPM CLI installation including the latest 26.5.1. While it is probably a false positive, it looks really bad and there's no way to upgrade it to a newer *tar* version. This issue is for Node.js 22.23.2 with ***@***.*** only. Node.js 26.5.1 has ***@***.*** bundled You can update to ***@***.*** with npm install -g ***@***.*** — Reply to this email directly, view it on GitHub <#9824?email_source=notifications&email_token=ACSFLMXB554LFDQFMHHNVR35HTVWLA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMJUGY2TQMBWGY3KM4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJLDGN5XXIZLSL5RWY2LDNM#issuecomment-5146580666>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ACSFLMRDWTZHJYURGNZLE6D5HTVWLAVCNFSNUABFKJSXA33TNF2G64TZHMYTGOJZGEYDEMRZHNEXG43VMU5TKMBSGY3DINZTGU3KC5QC> . Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS <https://github.com/notifications/mobile/ios/ACSFLMSXORBN62EOV3OEMXT5HTVWLA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMJUGY2TQMBWGY3KM4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJKTGN5XXIZLSL5UW64Y> and Android <https://github.com/notifications/mobile/android/ACSFLMRNQQOKZERZ5A5E67T5HTVWLA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMJUGY2TQMBWGY3KM4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJLTGN5XXIZLSL5QW4ZDSN5UWI>. Download it today! You are receiving this because you were mentioned.Message ID: ***@***.***>

[MikeMcC399]

From the standpoint of npm, this issue is resolved through nodejs/node#64884.

The next steps have to be carried out by Node.js

• Keeping npm up to date in Node.js #9827 relates

[aliceshi-aaaaaokkk]

tar (package.json) │ GHSA-r292-9mhp-454m │ MEDIUM │ │ 7.5.19 │ 7.5.21

This issue is for npm all versions.......

[MikeMcC399]

@aliceshi-aaaaaokkk

tar (package.json) │ GHSA-r292-9mhp-454m │ MEDIUM │ │ 7.5.19 │ 7.5.21

This issue is for npm all versions.......

This issue is closed, and the vulnerability you refer to is a different one.

It is not CVE-2026-59873 (GHSA-23hp-3jrh-7fpw).

[MikeMcC399]

@aliceshi-aaaaaokkk

Note also the advice in the bug reporting template, which says:

---

This is not just a request to bump a dependency for a CVE

npm bundles its dependencies and updates them on a regular cadence, so CVEs in our bundled dependencies are picked up automatically. Issues opened solely to request a dependency bump for a CVE will be closed.

---

So your new issues go against this advice and you should probably close the issues, and just wait for the updates to happen automatically.

The issue here was not about bumping dependencies, it was about providing an existing release to Node.js.