CVE-2026-59873

Critical

Advisory

Published 8 Jul 2026In the index since 5 Sept 2026

Severity: Critical; worst across findings
CVSS: 9.2; base score, highest
EPSS: 0.006; 45th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 897; of 17,787 indexed, latest versions
Container images: 926; deployed by those charts
Fix available: 2 of 3; affected packages

node-tar: Decompression/parse DoS via unlimited input

Carried by container images the latest versions of 897 of 17,787 indexed charts deploy, on 926 images.

Affected package	Affected versions	Fixed in	Images
npmapk	11.17.0-r0	12.0.0-r1	1
tarnpm	1.0.3, 2.2.1, 2.2.2, 4.0.2+32 more	7.5.19	926
node-tardeb	1.0.3-2, 2.2.1-1, 4.4.10+ds1-2ubuntu1, 6.1.13+~cs7.0.5-3	no fix listed	6

OSV records: CGA-hxjr-75xr-3m9c GHSA-23hp-3jrh-7fpw UBUNTU-CVE-2026-59873
Also known as: CGA-w28j-p9gq-x49x

Charts affected

897 by stars

Chart

Latest

Affected images

Radar Score

splice-helmsplice-helm

0.1.7

1 of 13 See more

splice-helm splice-helm 0.1.7

1 of the 13 container images this version deploys carry CVE-2026-59873.

Container image	Digest	Package	Fixed in
jupyterhub/configurable-http-proxy :3.0.0	c36cf3cc1c99	tar@2.2.1	7.5.19

Open the chart page →

1,477

stackradar-scannerstackradar

0.3.0

1 of 1 See more

stackradar-scanner stackradar 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-59873.

Container image	Digest	Package	Fixed in
ghcr.io/lockdep/stackradar-scanner :0.3.0	dd8a35d50c2d	tar@7.5.11	7.5.19

Open the chart page →

1,209

statsdstatsd-airflow-smd

0.1.19

1 of 1 See more

statsd statsd-airflow-smd 0.1.19

1 of the 1 container images this version deploys carry CVE-2026-59873.

Container image	Digest	Package	Fixed in
statsd/statsd :v0.8.6	dab129e74c25	tar@4.4.6	7.5.19

Open the chart page →

4,185

stornxstornx

1.1.1

1 of 9 See more

11,574

ackeesuda

0.2.1

1 of 1 See more

1,602

supabasesupabse

0.8.0

3 of 11 See more

supabase supabse 0.8.0

3 of the 11 container images this version deploys carry CVE-2026-59873.

Container image	Digest	Package	Fixed in
supabase/postgres-meta :v0.96.6	a84cc713585e	tar@6.2.1	7.5.19
supabase/storage-api :v1.60.4	c8eb9858eafe	tar@7.5.11	7.5.19
supabase/studio :2026.08.03-sha-022b374	606aca9fdaa7	tar@7.5.11	7.5.19

Open the chart page →

18,075

tenuretenure

1.0.6

1 of 2 See more

2,522

testhubteshub

0.1.4

1 of 3 See more

testhub teshub 0.1.4

1 of the 3 container images this version deploys carry CVE-2026-59873.

Container image	Digest	Package	Fixed in
testhubio/testhub-frontend :on-prem	e86c2db53be8	tar@4.4.13	7.5.19

Open the chart page →

7,517

unitycatalogunitycatalog

0.0.2

1 of 4 See more

unitycatalog unitycatalog 0.0.2

1 of the 4 container images this version deploys carry CVE-2026-59873.

Container image	Digest	Package	Fixed in
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui :0.2.1-5d668c1	ed07e7ca098d	tar@6.2.1	7.5.19

Open the chart page →

12,581

taigaunxwares

2026.3.8

1 of 6 See more

taiga unxwares 2026.3.8

1 of the 6 container images this version deploys carry CVE-2026-59873.

Container image	Digest	Package	Fixed in
taigaio/taiga-events :latest	92fc0822564f	tar@6.1.11	7.5.19

Open the chart page →

9,148

prerenderutkuozdemir

1.1.2

1 of 1 See more

prerender utkuozdemir 1.1.2

1 of the 1 container images this version deploys carry CVE-2026-59873.

Container image	Digest	Package	Fixed in
tvanro/prerender-alpine :6.4.0	6909015f0328	tar@4.4.19	7.5.19

Open the chart page →

2,660

restreamerutkuozdemir

1.1.0

1 of 1 See more

restreamer utkuozdemir 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-59873.

Container image	Digest	Package	Fixed in
datarhei/restreamer :0.6.4	655e12f9eeed	tar@4.4.13	7.5.19

Open the chart page →

2,598

vaultwarden-kubernetes-secretsvaultwarden-kubernetes-secrets

0.0.0-main

1 of 2 See more

vaultwarden-kubernetes-secrets vaultwarden-kubernetes-secrets 0.0.0-main

1 of the 2 container images this version deploys carry CVE-2026-59873.

Container image	Digest	Package	Fixed in
ghcr.io/antoniolago/vaultwarden-kubernetes-secrets :0.0.0-main	13e267ad7d94	tar@6.2.1	7.5.19

Open the chart page →

4,010

devportal-admin-uiveecode-platform

0.5.4

1 of 1 See more

devportal-admin-ui veecode-platform 0.5.4

1 of the 1 container images this version deploys carry CVE-2026-59873.

Container image	Digest	Package	Fixed in
veecode/devportal-admin-ui :0.4.30	c69fd286b489	tar@6.2.1	7.5.19

Open the chart page →

5,225

tdarrvhdirk

5.0.5

1 of 2 See more

tdarr vhdirk 5.0.5

1 of the 2 container images this version deploys carry CVE-2026-59873.

Container image	Digest	Package	Fixed in
haveagitgat/tdarr_node :2.17.01	3ff0913202dd	tar@6.1.14	7.5.19

Open the chart page →

26,657

wachdwachd

0.4.37

1 of 1 See more

wachd wachd 0.4.37

1 of the 1 container images this version deploys carry CVE-2026-59873.

Container image	Digest	Package	Fixed in
ghcr.io/wachd/wachd :0.4.18	05b05c56da94	tar@7.5.11	7.5.19

Open the chart page →

1,269

wikiwenerme

2.2.0

1 of 2 See more

3,833

scrapoxywiremind

0.3.4

1 of 1 See more

scrapoxy wiremind 0.3.4

1 of the 1 container images this version deploys carry CVE-2026-59873.

Container image	Digest	Package	Fixed in
wiremind/scrapoxy :latest	e7048929a676	tar@4.4.13	7.5.19

Open the chart page →

2,154

wraftwraft

0.1.12

1 of 9 See more

wraft wraft 0.1.12

1 of the 9 container images this version deploys carry CVE-2026-59873.

Container image	Digest	Package	Fixed in
quay.io/wraft/wraft-frontend :latest	f1bbbd5e9bb9	tar@6.2.1	7.5.19

Open the chart page →

10,090

youtubedl-materialyoutubedl-material

0.0.1

1 of 1 See more

youtubedl-material youtubedl-material 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-59873.

Container image	Digest	Package	Fixed in
tzahi12345/youtubedl-material :latest	2f943d584711	tar@6.1.11	7.5.19

Open the chart page →

9,783

qleverzazuko

0.7.0

1 of 2 See more

qlever zazuko 0.7.0

1 of the 2 container images this version deploys carry CVE-2026-59873.

Container image	Digest	Package	Fixed in
ghcr.io/zazukoians/qlever-ui :v0.10.0	34c7b540a095	tar@7.4.3	7.5.19

Open the chart page →

2,900

crowdsec-web-uizekker6

0.51.0

1 of 1 See more

crowdsec-web-ui zekker6 0.51.0

1 of the 1 container images this version deploys carry CVE-2026-59873.

Container image	Digest	Package	Fixed in
ghcr.io/theduffman85/crowdsec-web-ui :2026.8.3	bfadbab9a72c	tar@7.5.15	7.5.19

Open the chart page →

1,411

open5gsadaptivenetlab

1.0.3

1 of 3 See more

open5gs adaptivenetlab 1.0.3

1 of the 3 container images this version deploys carry CVE-2026-59873.

Container image	Digest	Package	Fixed in
registry.gitlab.com/infinitydon/registry/open5gs-webui :v2.2.2	fda21b0a0344	tar@4.4.13	7.5.19

Open the chart page →

25,443

adeptia-automate-mcpadeptia-automate-mcp

1.0.0

2 of 2 See more

adeptia-automate-mcp adeptia-automate-mcp 1.0.0

2 of the 2 container images this version deploys carry CVE-2026-59873.

Container image	Digest	Package	Fixed in
adeptiainc/adeptia-automate-mcp-server :1.0.0	283001e83739	tar@7.4.3	7.5.19
adeptiainc/adeptia-automate-observe :1.0.0	31f295e948e6	tar@7.4.3	7.5.19

Open the chart page →

3,600

admin-portaladmin-web-portal

1.2.1

1 of 2 See more

admin-portal admin-web-portal 1.2.1

1 of the 2 container images this version deploys carry CVE-2026-59873.

Container image	Digest	Package	Fixed in
soulou2019/node-server :latest	5e6ecfcc109e	tar@6.1.11	7.5.19

Open the chart page →

3,419

activepiecesadnoctem

0.5.0

1 of 1 See more

activepieces adnoctem 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-59873.

Container image	Digest	Package	Fixed in
activepieces/activepieces :0.90.4	30c10a04fe3d	tar@6.2.1	7.5.19

Open the chart page →

1,055

lhciadnoctem

0.1.0

1 of 1 See more

lhci adnoctem 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-59873.

Container image	Digest	Package	Fixed in
ghcr.io/adnoctem/lhci :1.0.1	19553e4b4033	tar@6.2.1	7.5.19

Open the chart page →

1,248

linkwardenadnoctem

0.5.1

1 of 2 See more

linkwarden adnoctem 0.5.1

1 of the 2 container images this version deploys carry CVE-2026-59873.

Container image	Digest	Package	Fixed in
ghcr.io/linkwarden/linkwarden :v2.16.3	0664c28a039b	tar@7.5.11	7.5.19

Open the chart page →

3,820

outlineadnoctem

0.1.2

1 of 1 See more

outline adnoctem 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-59873.

Container image	Digest	Package	Fixed in
outlinewiki/outline :1.10.1	832051f039b4	tar@7.5.15	7.5.19

Open the chart page →

1,216

uptime-kumaadnoctem

0.4.1

1 of 1 See more

uptime-kuma adnoctem 0.4.1

1 of the 1 container images this version deploys carry CVE-2026-59873.

Container image	Digest	Package	Fixed in
louislam/uptime-kuma :2.5.4	917318f9d7be	tar@7.5.11	7.5.19

Open the chart page →

30,028

turborepo-remote-cacheadriantr

1.1.1

1 of 1 See more

turborepo-remote-cache adriantr 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-59873.

Container image	Digest	Package	Fixed in
ducktors/turborepo-remote-cache :latest	31ec9e83c844	tar@7.5.11	7.5.19

Open the chart page →

523

akto-mini-testingakto

1.45.7

1 of 5 See more

akto-mini-testing akto 1.45.7

1 of the 5 container images this version deploys carry CVE-2026-59873.

Container image	Digest	Package	Fixed in
public.ecr.aws/aktosecurity/akto-puppeteer-replay :1.49.4_latest	f1c5763d565e	tar@7.5.9	7.5.19

Open the chart page →

6,486

akto-source-code-analyserakto

0.1.5

1 of 3 See more

akto-source-code-analyser akto 0.1.5

1 of the 3 container images this version deploys carry CVE-2026-59873.

Container image	Digest	Package	Fixed in
aktosecurity/akto-puppeteer-replay :doom_latest	853e37321e6e	tar@6.2.1	7.5.19

Open the chart page →

4,880

homepagealareira

1.0.1

1 of 1 See more

homepage alareira 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-59873.

Container image	Digest	Package	Fixed in
ghcr.io/gethomepage/homepage :latest	753eeb0cc22a	tar@7.5.11	7.5.19

Open the chart page →

352

cross-seedalekc

7.19.0

1 of 1 See more

cross-seed alekc 7.19.0

1 of the 1 container images this version deploys carry CVE-2026-59873.

Container image	Digest	Package	Fixed in
ghcr.io/cross-seed/cross-seed :6.13.7	a1fed512261f	tar@6.2.1	7.5.19

Open the chart page →

1,384

excalidashalekc

1.4.0

1 of 2 See more

excalidash alekc 1.4.0

1 of the 2 container images this version deploys carry CVE-2026-59873.

Container image	Digest	Package	Fixed in
zimengxiong/excalidash-backend :0.6.0	cbdab75f31b2	tar@6.2.1	7.5.19

Open the chart page →

904

allure-docker-helm-chartallure-service-chart

0.1.0

1 of 2 See more

allure-docker-helm-chart allure-service-chart 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-59873.

Container image	Digest	Package	Fixed in
frankescobar/allure-docker-service-ui :latest	4ebd8b4ef340	tar@4.4.13	7.5.19

Open the chart page →

3,647

openhab-cloudandibraeu

1.2.6

1 of 1 See more

openhab-cloud andibraeu 1.2.6

1 of the 1 container images this version deploys carry CVE-2026-59873.

Container image	Digest	Package	Fixed in
openhab/openhab-cloud :a8138a3	29dd2bac8c4b	tar@6.1.0	7.5.19

Open the chart page →

3,437

angular-chartangular-application

0.1.0

1 of 1 See more

angular-chart angular-application 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-59873.

Container image	Digest	Package	Fixed in
ibarreche/cloud-front-ci :latest	c8970ac1c8dc	tar@4.4.19	7.5.19

Open the chart page →

3,237

angular-node-chartangular-webapp

2.0.0

1 of 1 See more

angular-node-chart angular-webapp 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-59873.

Container image	Digest	Package	Fixed in
rakii8585/angular-node-webapp :latest	026082a515ac	tar@4.4.13	7.5.19

Open the chart page →

2,616

ansible-inspecansible-inspec

0.2.17

1 of 2 See more

ansible-inspec ansible-inspec 0.2.17

1 of the 2 container images this version deploys carry CVE-2026-59873.

Container image	Digest	Package	Fixed in
ghcr.io/htunn/ansible-inspec :0.2.12	cd25a5cc3f1b	tar@6.2.1	7.5.19

Open the chart page →

5,558

lametric-nightscout-proxyaolde

0.1.0

1 of 1 See more

lametric-nightscout-proxy aolde 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-59873.

Container image	Digest	Package	Fixed in
ghcr.io/aolde/lametric-nightscout-proxy :latest	7d1951b6baf5	tar@6.1.15	7.5.19

Open the chart page →

1,186

apimap-developerapimap

1.4.1

1 of 1 See more

apimap-developer apimap 1.4.1

1 of the 1 container images this version deploys carry CVE-2026-59873.

Container image	Digest	Package	Fixed in
apimap/developer :v1.3.1	406d3858e20c	tar@6.1.11	7.5.19

Open the chart page →

2,353

apimap-portalapimap

2.4.0

1 of 1 See more

apimap-portal apimap 2.4.0

1 of the 1 container images this version deploys carry CVE-2026-59873.

Container image	Digest	Package	Fixed in
apimap/portal :v2.4.0	041a4790c65c	tar@6.1.11	7.5.19

Open the chart page →

2,396

d.vazquezm.2021_helmapphelm

1.0.0

2 of 6 See more

d.vazquezm.2021_helm apphelm 1.0.0

2 of the 6 container images this version deploys carry CVE-2026-59873.

Container image	Digest	Package	Fixed in
davidvmar/urjc-davidvmar-external-service :1.0.0	2a68e9ac7f09	tar@4.4.13	7.5.19
davidvmar/urjc-davidvmar-server :1.0.0	5663f5b24615	tar@4.4.13	7.5.19

Open the chart page →

19,745

app-movies-seriesapp-movies-series

0.1.0

1 of 2 See more

app-movies-series app-movies-series 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-59873.

Container image	Digest	Package	Fixed in
felipecs8/app-movies-series :v1	4e51693fcdf5	tar@4.4.19	7.5.19

Open the chart page →

3,166

mongo-uiappscode

2026.3.30

1 of 1 See more

mongo-ui appscode 2026.3.30

1 of the 1 container images this version deploys carry CVE-2026-59873.

Container image	Digest	Package	Fixed in
ghcr.io/kubedb/mongo-gui :latest	ee0354b7a57a	tar@6.1.11	7.5.19

Open the chart page →

912

platform-uiappscode

2026.9.11

1 of 1 See more

platform-ui appscode 2026.9.11

1 of the 1 container images this version deploys carry CVE-2026-59873.

Container image	Digest	Package	Fixed in
ghcr.io/appscode/platform-ui :2.4.0	668ee2682eaf	tar@7.5.11	7.5.19

Open the chart page →

690

trifidappuio

2.0.2

1 of 1 See more

2,783

arma-reforgerarma-reforger

0.5.3

1 of 8 See more

arma-reforger arma-reforger 0.5.3

1 of the 8 container images this version deploys carry CVE-2026-59873.

Container image	Digest	Package	Fixed in
ghcr.io/brittonhayes/arma-reforger :latest	6fde1edc0983	tar@6.1.11	7.5.19

Open the chart page →

23,353

Container images carrying it

926 by charts deploying them

A fixed version is listed for 2 of the 3 affected packages.

Container image	Digest	Package	Fixed in	Used by
rahulbhiwagade122/desishowbiz :latest	08490b70998c	tar@6.2.1	7.5.19	1
rakii8585/angular-node-webapp :latest	026082a515ac	tar@4.4.13	7.5.19	1
redis/redisinsight :2.68	019fcf774631	tar@6.2.1	7.5.19	1
redis/redisinsight :3.2.0	55542a762210	tar@6.2.1	7.5.19	1
redis/redisinsight :2.46	699d341bd329	tar@6.1.15	7.5.19	1
redis/redisinsight :3.4	85562d67a912	tar@7.4.3	7.5.19	1
refar/apm-portal :v5.7.1	dcca8e4477a6	tar@4.4.13	7.5.19	1
requarks/wiki :canary-2.5.243	8b5865a7386c	tar@4.4.19	7.5.19	1
rlex/jsonvisio :1.9.5	cd50ff65118e	tar@4.4.19	7.5.19	1
roadiehq/community-backstage-image :latest	ef355bf5b639	tar@4.4.13	7.5.19	1
robotshop/rs-cart :latest	388349d5cb3c	tar@4.4.15	7.5.19	1
robotshop/rs-catalogue :latest	d545747c1b97	tar@4.4.15	7.5.19	1
robotshop/rs-user :latest	ea509182c180	tar@4.4.15	7.5.19	1
rocketadmin/rocketadmin :1.17.7	10955ef540b9	tar@7.5.13	7.5.19	1
rocketchat/account-service :8.6.1	44af8ac4e711	tar@7.5.16	7.5.19	1
rocketchat/authorization-service :8.6.1	6bc18fb5d0e5	tar@7.5.16	7.5.19	1
rocketchat/ddp-streamer-service :8.6.1	819771c4abe4	tar@7.5.16	7.5.19	1
rocketchat/presence-service :8.6.1	c1170bdfe797	tar@7.5.11	7.5.19	1
safeglobal/safe-client-gateway-nest :v1.51.0	12ccfd93fcaf	tar@6.2.1	7.5.19	1
saidsef/aws-kinesis-local :v2026.06	67025e3a163e	tar@7.5.15	7.5.19	1
samajh/alprbackend :latest	ea742b4372ad	tar@6.1.11	7.5.19	1
samajh/alprfrontend :latest	05ef4fddbb75	tar@6.1.11	7.5.19	1
shahanafarooqui/rtl :0.11.0	d0cd3d868aca	tar@4.4.13	7.5.19	1
sharanalwar/redchef-frontend :latest	5e82950b16b7	tar@6.2.1	7.5.19	1
shinobisystems/shinobi :dev	3ca746937856	tar@6.1.0	7.5.19	1
shinobisystems/shinobi :latest	c2f5ce2e1067	tar@6.1.0	7.5.19	1
shyamkrishna21/cloudvault :latest	af2785f5bb71	tar@6.2.1	7.5.19	1
shyamkrishna21/shopsync :latest	3998b83def53	tar@6.2.1	7.5.19	1
sigp/siren :v3.0.4	2c219b04758e	tar@7.4.3	7.5.19	1
siscc/dotstatsuite-data-lifecycle-manager :v14.0.0	b6f9a7c888fc	tar@4.4.19	7.5.19	1
sissbruecker/linkding :1.41.0-plus	a222fb777e1f	tar@6.2.1	7.5.19	1
skylenet/ethstats-server :pow-latest	d757cc016198	tar@6.1.11	7.5.19	1
slagattollas/server-practica :latest	6dd8ead8e2b1	tar@4.4.13	7.5.19	1
slagattollas/weatherservice-practica :latest	68e7f56393fc	tar@4.4.13	7.5.19	1
socialmediamacroscope/smile_graphql :0.3.1	c5095e94bc65	tar@4.4.2	7.5.19	1
socialmediamacroscope/smile_server :0.3.3	1a528c794270	tar@6.1.0	7.5.19	1
solidproject/community-server :6.0.2	ccc4acb7e9a1	tar@6.1.14	7.5.19	1
someblackmagic/alertmanager-to-alerta-bot :latest	78bf43744ea5	tar@4.4.19	7.5.19	1
someblackmagic/alert-mapper :v0.1.0	88351d85c04c	tar@4.4.19	7.5.19	1
soulou2019/node-server :latest	5e6ecfcc109e	tar@6.1.11	7.5.19	1
soulteary/cronicle :0.9.80	ac2512fa6e39	tar@6.2.1	7.5.19	1
speckle/speckle-preview-service :2.26.3	092384dba45d	tar@6.2.1	7.5.19	1
speckle/speckle-preview-service :2.20.2-branch.testing4.134160-9fad4b2	1f897ca906ea	tar@6.2.1	7.5.19	1
speckle/speckle-preview-service :2.21.3-branch.testing5.219631-2153bef	52cad5e3293e	tar@6.2.1	7.5.19	1
speckle/speckle-preview-service :2.23.14-branch.testing6.334655-b4e04ee	6dee853ba74a	tar@6.2.1	7.5.19	1
speckle/speckle-preview-service :2.25.10-branch.testing6.645-b125c1e	787adcb20a3a	tar@6.2.1	7.5.19	1
speckle/speckle-preview-service :2.17.14-branch.testing.72707.921a5f8	84fc39bca0c8	tar@6.2.0	7.5.19	1
speckle/speckle-preview-service :2.20.6-branch.testing1.154030-9b09114	8f3c1ea153ba	tar@6.2.1	7.5.19	1
speckle/speckle-preview-service :2.19.2-branch.hotfix-2.19.1.124125-665e7e1	c102b087481a	tar@6.2.1	7.5.19	1
speckle/speckle-preview-service :2.20.3-branch.hotfix-2.20.2.149555-37ea0cb	d3da0a84de98	tar@6.2.1	7.5.19	1