CVE-2026-59873 critical severity vulnerability in [email protected] for [email protected] #9801

Situation

Security scans report a critical severity vulnerability CVE-2026-59873 for [email protected] in [email protected] bundled in Node.js 22.23.1

Steps to reproduce

Scan the latest node:22 Docker image with trivy.

trivy image --ignore-unfixed --pkg-types library --scanners vuln --severity CRITICAL node:22.23.1

Background

• Node.js 22.23.1 is the latest Node.js 22.x release

• Node.js 22.x is in status Maintenance LTS until End-of-life on 2027-04-30. The definition of this phase states:

  Maintenance - Critical bug fixes and security updates.

• [email protected] is the latest npm 10.x release, published on March 27, 2026

• Although [email protected] already bundles [email protected], these higher versions of npm are not backported to Node.js 22.x, which remains using npm 10.x.

• [email protected] resolves CVE-2026-59873

• [email protected] is latest

Suggestion

• Update tar to >= 7.19.0 for npm 10.x and release with this update.

• Pass the new release to Node.js for bundling into Node.js 22.x