The vulnerability resides in the ASF (WMV/WMA) file type detection parser of the file-type library. When an ASF sub‑header’s size field is set to zero, the parser enters an infinite loop. The loop decrements a payload counter to a negative value, causing the tokenizer to move read position backwards and continuously reread the same sub‑header, ultimately stalling the Node.js event loop. This denial of service flaw is an instance of CWE‑835 (Infinite Loop). This flaw can be triggered by a crafted 55‑byte payload and results in a denial of service, disrupting legitimate application processing of untrusted or attacker‑controlled data.

The affected product is "sindresorhus:file-type" used in Node.js applications. Versions prior to 21.3.1 are impacted. Any code that calls file-type to examine user‑supplied files, streams, or raw data is vulnerable until the library is upgraded to 21.3.1 or later.

The CVSS score of 5.3 indicates a medium impact, while the EPSS score of less than 1% reflects a low probability of exploitation in the general population. The vulnerability is not listed in the CISA KEV catalog. Attackers who can supply crafted ASF content to an application that unconditionally passes data to file-type can cause the event loop to freeze, effectively denying service to all users of that instance. Even though exploitation requires an altered ASF file, the flaw can be triggered with a small, non‑malicious looking payload, implying a moderate ease of attack once the condition is met.