Security: Node24 bundled npm includes vulnerable tar 7.5.15 (CVE-2026-59873)

Describe the bug
The GitHub Actions Runner currently bundles a vulnerable version of the npm tar package in its embedded Node 24 runtime.

We are using GitHub Actions Runner version 2.336.0 in a custom Docker-based self-hosted runner.

Trivy reports the following vulnerability:

Package: tar (node-tar)
Installed version: 7.5.15
Fixed version: 7.5.19
CVE: CVE-2026-59873
Severity: Critical
Advisory: https://github.com/advisories/GHSA-23hp-3jrh-7fpw
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-59873
Affected path
The vulnerable package is bundled inside the GitHub Actions Runner:

/home/runner/actions-runner/externals/node24/lib/node_modules/npm/node_modules/tar/package.json

The installed package reports:

"name": "tar"
"version": "7.5.15"

The GitHub Actions Runner version being used is:

2.336.0
Reproduction
We are building a Docker image based on Ubuntu 24.04 and installing the GitHub Actions Runner:

FROM ubuntu:24.04

ENV GH_RUNNER_VERSION="2.336.0"

RUN cd /home/runner/actions-runner &&
curl -O -L https://github.com/actions/runner/releases/download/v${GH_RUNNER_VERSION}/actions-runner-linux-x64-${GH_RUNNER_VERSION}.tar.gz &&
tar xzf ./actions-runner-linux-x64-${GH_RUNNER_VERSION}.tar.gz

After extracting the runner, the vulnerable package can be located with:

find /home/runner/actions-runner
-path "*/node_modules/tar/package.json"
-exec grep -E '"name"|"version"' {} ;

This returns the bundled tar package at version 7.5.15.

Expected behavior
The GitHub Actions Runner distribution should bundle a version of node-tar that is not affected by CVE-2026-59873.

Expected:

tar >= 7.5.19

Actual behavior
Runner 2.336.0 contains:

tar 7.5.15

which is affected by CVE-2026-59873.
Impact

The GitHub Advisory describes CVE-2026-59873 as a critical decompression/parse denial-of-service vulnerability in node-tar. A crafted gzip/tar archive can cause excessive resource consumption.

This dependency is not a direct application dependency. It is bundled within the npm installation shipped with the GitHub Actions Runner.

Request

Could the GitHub Actions Runner team update the bundled Node 24/npm dependency to a version containing:

tar >= 7.5.19

or otherwise provide a runner release that no longer contains the vulnerable dependency?

We are currently using the latest available runner version, 2.336.0, so we cannot remediate this by upgrading the runner further.

Thank you.

Start by tracing how the runner distribution assembles externals/node24 and inspect /home/runner/actions-runner/externals/node24/lib/node_modules/npm/node_modules/tar/package.json. Confirm where the bundled npm dependency is sourced, update it to tar 7.5.19 or later, and verify the extracted runner no longer reports version 7.5.15.