Backport CVE-2026-59873 fix by upgrading the bundled node-tar
package (within npm) from 7.5.15 to 7.5.19. The patch extracts
only the 13 tar-related files from the upstream npm 11.18.0
upgrade commit. Key security fixes include a
maxDecompressionRatio guard in the tar parser, rejection of
negative size values in headers and PAX extensions, and
String() wrapping in normalize-windows-path. Conflicts with
the RHEL base (7.5.15 vs expected 7.5.16) were resolved
manually in header.js, index.min.js, and package.json.
CVE: CVE-2026-59873, CVE-2026-58874
Upstream patches:
- fd35018553.patch
Advisories:
https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5whttps://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw
Resolves: RHEL-193835 RHEL-193868
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
9204b107c8