CLEANSTART-2026-LK29994: node-tar is a tar archive manipulation library for Node

Q: Does exploitation require authentication or user interaction?

No. The reported vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.

Q: What is the reported impact?

The reported impact is limited to availability, rated Low. No confidentiality or integrity impact is indicated by the provided vector.

Q: Can the affected versions or a workaround be identified from this advisory data?

No affected version range, fixed version, configuration guidance, or mitigation is provided in the available data.

Published Nov 5, 2026

Updated

Security vulnerability affects the npm package. node-tar is a tar archive manipulation library for Node.

Affected Software

1 affected componentFixes available

cleanstart/npm<10.9.2-r1

10.9.2-r1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/npm to a version that resolves this vulnerability.
Fixed in 10.9.2-r1

Event History

Nov 5, 2026

Advisory Published

via OSV·06:32 AM

Data Sourced

via OSV·06:32 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-59875

Frequently Asked Questions

Does exploitation require authentication or user interaction?

No. The reported vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.

What is the reported impact?

The reported impact is limited to availability, rated Low. No confidentiality or integrity impact is indicated by the provided vector.

Can the affected versions or a workaround be identified from this advisory data?

No affected version range, fixed version, configuration guidance, or mitigation is provided in the available data.

CLEANSTART-2026-LK29994: node-tar is a tar archive manipulation library for Node

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Does exploitation require authentication or user interaction?

What is the reported impact?

Can the affected versions or a workaround be identified from this advisory data?

Company

Resources

Contact

Frequently Asked Questions

Does exploitation require authentication or user interaction?

What is the reported impact?

Can the affected versions or a workaround be identified from this advisory data?