CVE-2026-59874 (HIGH): detected in Lambda Docker Images.

[the-lambda-watchdog]

CVE Details

CVE ID	Severity	Affected Package	Installed Version	Fixed Version	Date Published	Date of Scan
CVE-2026-59874	HIGH	tar	7.5.15	7.5.18	2026-07-08T16:16:33.99Z	2026-07-22T10:18:15.468343918Z

---

Affected Docker Images

Image Name	SHA
public.ecr.aws/lambda/nodejs:latest	public.ecr.aws/lambda/nodejs@sha256:eca040a64243f44373fae948c0c1e13563d924a0b4c1b6a3c18d598f288ebf3f
public.ecr.aws/lambda/nodejs:24	public.ecr.aws/lambda/nodejs@sha256:eca040a64243f44373fae948c0c1e13563d924a0b4c1b6a3c18d598f288ebf3f
public.ecr.aws/lambda/nodejs:22	public.ecr.aws/lambda/nodejs@sha256:7fb30f61a372768a2ee1c1af89340e2b3b69782bc1135b0101669ee1106d1d0c

---

Description

node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.

---

Remediation Steps

• Update the affected package tar from version 7.5.15 to 7.5.18.

About this issue

• This issue may not contain all the information about the CVE nor the images it affects.
• This issue will not be updated with new information and the list of affected images may have changed since the creation of this issue.
• For more, visit Lambda Watchdog.
• This issue was created automatically by Lambda Watchdog.