CVE-2026-59874 (HIGH): detected in Lambda Docker Images.

Open Beginner friendly

#628 opened on Jul 22, 2026 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 2/5
Estimated time: 1-3 hours
Newbie friendliness: 65/100

Issue type: Bug
Clarity: Mostly clear
Activity status: Quiet
Tech stack: aws, docker, node.js
Domain: cloud, infrastructure, security

Research direction

Start by locating how the public.ecr.aws/lambda/nodejs:22 and :24 images obtain the tar package. Update the affected package from 7.5.15 to 7.5.18, rebuild the relevant images, and verify that the vulnerability scan no longer reports CVE-2026-59874.

Written by the indexing model from the issue text.

Description

CVE Details

CVE ID	Severity	Affected Package	Installed Version	Fixed Version	Date Published	Date of Scan
CVE-2026-59874	`HIGH`	`tar`	`7.5.15`	`7.5.18`	`2026-07-08T16:16:33.99Z`	`2026-07-22T10:18:15.468343918Z`

Affected Docker Images

Image Name	SHA
`public.ecr.aws/lambda/nodejs:latest`	`public.ecr.aws/lambda/nodejs@sha256:eca040a64243f44373fae948c0c1e13563d924a0b4c1b6a3c18d598f288ebf3f`
`public.ecr.aws/lambda/nodejs:24`	`public.ecr.aws/lambda/nodejs@sha256:eca040a64243f44373fae948c0c1e13563d924a0b4c1b6a3c18d598f288ebf3f`
`public.ecr.aws/lambda/nodejs:22`	`public.ecr.aws/lambda/nodejs@sha256:7fb30f61a372768a2ee1c1af89340e2b3b69782bc1135b0101669ee1106d1d0c`

Description

node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.

Remediation Steps

Update the affected package tar from version 7.5.15 to 7.5.18.

About this issue

This issue may not contain all the information about the CVE nor the images it affects.
This issue will not be updated with new information and the list of affected images may have changed since the creation of this issue.
For more, visit Lambda Watchdog.
This issue was created automatically by Lambda Watchdog.

Dominant language: No language data
Stars: 777
Forks: 118
PR merge metrics: No merged PRs in 30d

Contributor guide

Open the contributing guide

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

[BUG] GkeTpuCluster queries metadata.google.internal for MEGASCALE_SLICE_ID even when TPU_SKIP_MDS_QUERY is set Open

Difficulty 2/5 1-3 hours Newbie friendliness 88/100

jax-ml/jax#40854 · Opened Sep 22, 2026
fix(mcp): `permanently_delete_cloud_{source,destination,connection}` lack `workspace_id` param, unusable without a default workspace Open

bug

Difficulty 2/5 1-3 hours Newbie friendliness 88/100

airbytehq/PyAirbyte#1201 · Opened Sep 21, 2026
[BUG] Route53Resolver: CreateResolverEndpoint requires IpAddressRequests, but the AWS member is IpAddresses, so no SDK client can call it Open

Difficulty 2/5 1-3 hours Newbie friendliness 84/100

floci-io/floci#4108 · Opened Sep 21, 2026
wm_gcp_parse_output underflows its heap buffer by one byte Open

level/task module/gcp type/bug

Difficulty 2/5 1-3 hours Newbie friendliness 85/100

wazuh/wazuh#39525 · Opened Sep 21, 2026
[Bug]: aws_lb_listener silently ignores tcp_idle_timeout_seconds on TCP_UDP listeners Open

bug needs-triage service/elbv2

Difficulty 2/5 1-3 hours Newbie friendliness 82/100

hashicorp/terraform-provider-aws#50100 · 1 comment · Opened Sep 21, 2026

More Cloud issues

CVE-2026-59874 (HIGH): detected in Lambda Docker Images.

Assessment

Research direction

Description

CVE Details

Affected Docker Images

Description

Remediation Steps

About this issue

Contributor guide

First steps

More from aws/aws-lambda-base-images

Similar issues

Get new issues in your inbox