A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header…
A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails. When `zipEntry.modified` is read on an archive whose local header does not match its central directory, either directly or while compacting the archive, the validation error is caught but the parsed local header is left cached without a content offset. A later content read then returns attacker-controlled bytes from the start of the file instead of rejecting the archive, and CRC-32 verification still passes because the attacker co
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Node.js
- Product
- ImageMagick / Ghostscript / FFmpeg / libxml2, Node.js
- CVSS
- 3.7
- EPSS
- 0.003 (p28)
- Exposure class
- Developer platform
Why it ranks 17 (Routine)
- Product class: developer platform
- Covered by 3 independent sources
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-106070 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.