CVE-2026-59875 node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records

CVE-2026-59871 node-tar: Process crash via PAX numeric path type confusion

CVE-2026-59873 node-tar: Decompression/parse DoS via unlimited input

CVE-2026-59874 node-tar: Negative tar entry size causes infinite loop in archive replace

CVE-2026-53655 node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)