The vulnerability resides in the file-type library’s ZIP handling, where a crafted ZIP file can trigger excessive memory growth during type detection. This occurs when fileTypeFromBuffer(), fileTypeFromBlob(), or fileTypeFromFile() process a small compressed ZIP that expands to a much larger payload, exploiting the absence of an inflate output limit for known-size inputs. The resulting memory exhaustion can cause the application to crash or become unresponsive, constituting a denial of service. The weakness is classified as CWE-409.

The issue affects the npm package 'sindresorhus/file-type' in all versions from 20.0.0 up to and including 21.3.1. Versions 21.3.2 and later incorporate the fix and are not affected.

The CVSS score of 5.3 indicates a medium severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack vector, though not explicitly stated, is inferred to require an attacker to supply a crafted ZIP file to the application’s type detection logic, making it a local or supply‑of‑data exploitation scenario rather than a remote network attack.