CVE-2026-59873 critical severity vulnerability in tar@7.5.11 for npm@10.9.8 in Node.js 22.23.2

[MikeMcC399]

• follows on from CVE-2026-59873 critical severity vulnerability in tar@7.5.11 for npm@10.9.8 #9801

Situation

• Security scans report a critical severity vulnerability CVE-2026-59873 for tar@7.5.11 in npm@10.9.8 bundled in the security update Node.js 22.23.2, released July 29. 2029.

• npm@10.9.9 is the latest npm 10.x release, published on July 29, 2026. It updates to tar@7.5.22, remediating the vulnerability CVE-2026-59873 for tar@7.5.11

• npm@10.9.9 is not present in any PR or the v22.x-staging branch in the repo nodejs/node to upgrade Node.js 22.x to this version of npm.

Steps to reproduce

Scan the latest node:22 Docker image with trivy.

trivy image --ignore-unfixed --pkg-types library --scanners vuln --severity CRITICAL node:22.23.2

Background

• Node.js 22.23.2 is the latest Node.js 22.x release

• Node.js 22.x is in status Maintenance LTS until End-of-life on 2027-04-30. The definition of this phase states:

  Maintenance - Critical bug fixes and security updates.

Suggestion

• Pass npm@10.9.9 to Node.js for bundling into Node.js 22.x

[ggioshvili]

Wiz is now reporting this a a Critical issue for every NPM CLI installation including the latest 26.5.1. While it is probably a false positive, it looks really bad and there's no way to upgrade it to a newer tar version.

[MikeMcC399]

@ggioshvili

Wiz is now reporting this a a Critical issue for every NPM CLI installation including the latest 26.5.1. While it is probably a false positive, it looks really bad and there's no way to upgrade it to a newer tar version.

This issue is for Node.js 22.23.2 with npm@10.9.8 only.

Node.js 26.5.1 has npm@11.17.0 bundled

You can update to npm@11.18.0 with

npm install -g npm@11

[ggioshvili]

Thank you!

…

On Fri, Jul 31, 2026 at 2:13 PM Mike McCready ***@***.***> wrote: *MikeMcC399* left a comment (npm/cli#9824) <#9824 (comment)> @ggioshvili <https://github.com/ggioshvili> Wiz is now reporting this a a *Critical* issue for every NPM CLI installation including the latest 26.5.1. While it is probably a false positive, it looks really bad and there's no way to upgrade it to a newer *tar* version. This issue is for Node.js 22.23.2 with ***@***.*** only. Node.js 26.5.1 has ***@***.*** bundled You can update to ***@***.*** with npm install -g ***@***.*** — Reply to this email directly, view it on GitHub <#9824?email_source=notifications&email_token=ACSFLMXB554LFDQFMHHNVR35HTVWLA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMJUGY2TQMBWGY3KM4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJLDGN5XXIZLSL5RWY2LDNM#issuecomment-5146580666>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ACSFLMRDWTZHJYURGNZLE6D5HTVWLAVCNFSNUABFKJSXA33TNF2G64TZHMYTGOJZGEYDEMRZHNEXG43VMU5TKMBSGY3DINZTGU3KC5QC> . Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS <https://github.com/notifications/mobile/ios/ACSFLMSXORBN62EOV3OEMXT5HTVWLA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMJUGY2TQMBWGY3KM4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJKTGN5XXIZLSL5UW64Y> and Android <https://github.com/notifications/mobile/android/ACSFLMRNQQOKZERZ5A5E67T5HTVWLA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMJUGY2TQMBWGY3KM4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJLTGN5XXIZLSL5QW4ZDSN5UWI>. Download it today! You are receiving this because you were mentioned.Message ID: ***@***.***>