yauzl, the Node.js unzip library, contains an off‑by‑one error in the NTFS extended timestamp extra field parser used by the getLastModDate() function. The loop condition incorrectly allows the parser to read past the end of the buffer, resulting in an ERR_OUT_OF_RANGE exception that crashes the entire process. A remote attacker can trigger this by delivering a crafted zip file with a malformed NTFS extra field, causing the application to terminate. This is a classic buffer overread leading to a denial‑of‑service attack and fits CWE‑193.

The vulnerability is present in thejoshwolfe:yauzl library, version 3.2.0, as used by any Node.js application that processes zip uploads and calls entry.getLastModDate() on parsed entries. The issue was fixed in version 3.2.1; no other vendors or products are listed as affected.

The CVSS base score is 6.9, indicating moderate severity. The EPSS score is below 1 %, suggesting that exploitation is expected to be rare. The vulnerability is not included in the CISA KEV catalog. Attackers can exploit the flaw remotely by supplying a crafted zip file to an application that uses yauzl. There are no additional conditions beyond the presence of the malformed NTFS timestamp field; the exploit path is straightforward and does not require local privileges.