Description
A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails.

When `zipEntry.modified` is read on an archive whose local header does not match its central directory, either directly or while compacting the archive, the validation error is caught but the parsed local header is left cached without a content offset. A later content read then returns attacker-controlled bytes from the start of the file instead of rejecting the archive, and CRC-32 verification still passes because the attacker controls the central directory CRC. A Node.js-based scanner can therefore approve different content from what another ZIP implementation extracts from the same archive.

This vulnerability affects Node.js **26.x**.
Published: 2026-10-23
Score: 3.7 Low
EPSS: n/a
KEV: No
Impact: Information Disclosure
Action: Update Node
AI Analysis

Impact

A flaw in Node.js’s zlib.ZipFile API allows the extraction of unintended bytes from a ZIP archive when the local header and central directory do not match. The API may return attacker‑controlled data from the start of the file instead of rejecting the archive, while CRC‑32 verification still passes. This can cause consumers of the ZIP entry to receive malformed or malicious data, leading to integrity violations and potential downstream logic errors.

Affected Systems

Node.js 26.x is affected. The vulnerability is specific to the nodejs:node product.

Risk and Exploitability

The CVSS score of 3.7 indicates low severity, and the EPSS score is not available. The flaw is not listed in the CISA KEV catalog. Attacks require an application to use the zlib.ZipFile API with a ZIP archive that contains mismatched local and central headers. An attacker can craft such an archive and deliver it to a vulnerable Node.js process to influence the data extracted from the ZIP.

Generated by OpenCVE AI on October 23, 2026 at 17:46 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to the latest Node.js release that includes the fixed ZIP header validation
  • Validate ZIP entry offsets and CRC values before reading data when using zlib.ZipFile
  • Reject or sanitize archives with mismatched local and central headers before processing, or use a trusted third‑party ZIP extraction library

Generated by OpenCVE AI on October 23, 2026 at 17:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 18:15:00 +0000

Type Values Removed Values Added
Title Node.js zlib.ZipFile Header Validation Flaw Exposes Attacker-Controlled Data

Fri, 23 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Description A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails. When `zipEntry.modified` is read on an archive whose local header does not match its central directory, either directly or while compacting the archive, the validation error is caught but the parsed local header is left cached without a content offset. A later content read then returns attacker-controlled bytes from the start of the file instead of rejecting the archive, and CRC-32 verification still passes because the attacker controls the central directory CRC. A Node.js-based scanner can therefore approve different content from what another ZIP implementation extracts from the same archive. This vulnerability affects Node.js **26.x**.
Weaknesses CWE-840
References
Metrics cvssV3_0

{'score': 3.7, 'vector': 'CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: hackerone

Published:

Updated: 2026-10-23T16:15:05.741Z

Reserved: 2026-10-06T15:00:00.655Z

Link: CVE-2026-106070

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-23T17:17:19.917

Modified: 2026-10-23T17:17:19.917

Link: CVE-2026-106070

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T18:00:15Z

Weaknesses