Summary
The published banmanagement/webui:latest Docker image contains a critical vulnerability in the tar package (v7.5.16) that allows denial of service attacks.
Vulnerability Details
CVE ID: CVE-2026-59873
Package: tar
Affected Version: 7.5.16 (and earlier)
Fixed Version: 7.5.19
CVSS Score: 9.2 (Critical)
Impact: Allocation of Resources Without Limits or Throttling
Description
An attacker can provide a malicious tar file that causes excessive resource consumption, crashing the Node.js process and denying service to legitimate users.
Recommendation
Update the tar package to version 7.5.19 or later in package.json or package-lock.json, rebuild the Docker image, and republish to Docker Hub.
How to Reproduce
Run Docker Scout on the published image:
docker scout cves banmanagement/webui:latest --only-severity critical
Summary
The published banmanagement/webui:latest Docker image contains a critical vulnerability in the tar package (v7.5.16) that allows denial of service attacks.
Vulnerability Details
CVE ID: CVE-2026-59873
Package: tar
Affected Version: 7.5.16 (and earlier)
Fixed Version: 7.5.19
CVSS Score: 9.2 (Critical)
Impact: Allocation of Resources Without Limits or Throttling
Description
An attacker can provide a malicious tar file that causes excessive resource consumption, crashing the Node.js process and denying service to legitimate users.
Recommendation
Update the tar package to version 7.5.19 or later in package.json or package-lock.json, rebuild the Docker image, and republish to Docker Hub.
How to Reproduce
Run Docker Scout on the published image:
docker scout cves banmanagement/webui:latest --only-severity critical