CVE-2026-59871 (MEDIUM): detected in Lambda Docker Images.

[the-lambda-watchdog]

CVE Details

CVE ID	Severity	Affected Package	Installed Version	Fixed Version	Date Published	Date of Scan
CVE-2026-59871	MEDIUM	tar	7.5.15	7.5.18	2026-07-08T16:16:33.723Z	2026-07-22T10:18:15.468343918Z

---

Affected Docker Images

Image Name	SHA
public.ecr.aws/lambda/nodejs:latest	public.ecr.aws/lambda/nodejs@sha256:eca040a64243f44373fae948c0c1e13563d924a0b4c1b6a3c18d598f288ebf3f
public.ecr.aws/lambda/nodejs:24	public.ecr.aws/lambda/nodejs@sha256:eca040a64243f44373fae948c0c1e13563d924a0b4c1b6a3c18d598f288ebf3f
public.ecr.aws/lambda/nodejs:22	public.ecr.aws/lambda/nodejs@sha256:7fb30f61a372768a2ee1c1af89340e2b3b69782bc1135b0101669ee1106d1d0c

---

Description

node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPath(entry.path).split('/') to throw an uncaught TypeError. This issue is fixed in version 7.5.18.

---

Remediation Steps

• Update the affected package tar from version 7.5.15 to 7.5.18.

About this issue

• This issue may not contain all the information about the CVE nor the images it affects.
• This issue will not be updated with new information and the list of affected images may have changed since the creation of this issue.
• For more, visit Lambda Watchdog.
• This issue was created automatically by Lambda Watchdog.