CVE-2026-31808
mediumpriority · track · 0EPSS 0.003 · 27 %ileDEEUUSEPSS · scored 2026-10-26
file-type detects the file type of a file, stream, or data. Prior to 21.3.1, a denial of service vulnerability exists in the ASF (WMV/WMA) file type detection parser. When parsing a crafted input where an ASF sub-header has a size field of zero, the parser enters an infinite loop. The payload value becomes negative (-24), causing tokenizer.ignore(payload) to move the read position backwards, so the same sub-header is read repeatedly forever. Any application that uses file-type to detect the type of untrusted/attacker-controlled input is affected. An attacker can stall the Node.js event loop with a 55-byte payload. Fixed in version 21.3.1.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (5)
Products and version ranges known to be affected.
advisories (3)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2026-1940IBM App Connect Enterprise: Schwachstelle ermöglicht Denial of ServiceDeutsch2026-06-15csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in IBM App Connect Enterprise ausnutzen, um einen Denial of Service Angriff durchzuführen.
- WID-SEC-W-2026-3046IBM Concert: Mehrere SchwachstellenDeutsch2026-08-26csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in IBM Concert ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen, um einen SQL-Injection Angriff durchzuführen und um Sicherheitsvorkehrungen zu umgehen.
- GHSA-5v7r-6r5c-r473file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-header2026-03-10ghsa · osvUS
### Impact A denial of service vulnerability exists in the ASF (WMV/WMA) file type detection parser. When parsing a crafted input where an ASF sub-header has a `size` field of zero, the parser enters an infinite loop. The `payload` value becomes negative (-24), causing `tokenizer.ignore(payload)` to move the read position backwards, so the same sub-header is read repeatedly forever. Any application that uses `file-type` to detect the type of untrusted/attacker-controlled input is affected. An attacker can stall the Node.js event loop with a 55-byte payload. ### Patches Fixed in version 21.3.1. Users should upgrade to >= 21.3.1. ### Workarounds Validate or limit the size of input buffers before passing them to `file-type`, or run file type detection in a worker thread with a timeout. ### References - Fix commit: 319abf871b50ba2fa221b4a7050059f1ae096f4f ### Reporter crnkovic@lokvica.com
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (8)
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/cve-2026-31808cnnvd
- https://github.com/sindresorhus/file-type/commit/319abf871b50ba2fa221b4a7050059f1ae096f4fcnnvd
- https://github.com/sindresorhus/file-type/releasesPatchcnnvd
- https://github.com/sindresorhus/file-type/security/advisories/GHSA-5v7r-6r5c-r473cnnvd
- https://github.com/sindresorhus/file-type/commit/319abf871b50ba2fa221b4a7050059f1ae096f4fenisa_euvd
- https://github.com/sindresorhus/file-type/security/advisories/GHSA-5v7r-6r5c-r473enisa_euvd
- https://github.com/sindresorhus/file-type/commit/319abf871b50ba2fa221b4a7050059f1ae096f4fPatchnvd
- https://github.com/sindresorhus/file-type/security/advisories/GHSA-5v7r-6r5c-r473MitigationPatchVendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan