CVE-2026-31988
mediumpriority · track · 0EPSS 0.005 · 43 %ileDEEUUSEPSS · scored 2026-10-27
yauzl (aka Yet Another Unzip Library) version 3.2.0 for Node.js contains an off-by-one error in the NTFS extended timestamp extra field parser within the getLastModDate() function. The while loop condition checks cursor < data.length + 4 instead of cursor + 4 <= data.length, allowing readUInt16LE() to read past the buffer boundary. A remote attacker can cause a denial of service (process crash via ERR_OUT_OF_RANGE exception) by sending a crafted zip file with a malformed NTFS extra field. This affects any Node.js application that processes zip file uploads and calls entry.getLastModDate() on parsed entries. Fixed in version 3.2.1.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 2.7–6.9
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (15)
Products and version ranges known to be affected.
- IBM App Connect Enterprise 12.0.1.0-12.0.12.25all versionscert_bundDEcpe:/a:ibm:app_connect_enterprise:12.0.1.0_-_12.0.12.25
- IBM App Connect Enterprise 13.0.1.0-13.0.7.1all versionscert_bundDEcpe:/a:ibm:app_connect_enterprise:13.0.1.0_-_13.0.7.1
advisories (2)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2026-1220IBM App Connect Enterprise: Mehrere SchwachstellenDeutsch2026-04-21csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Dateien zu manipulieren, und um einen Denial of Service Angriff durchzuführen.
- GHSA-gmq8-994r-jv83yauzl contains an off-by-one error2026-03-12ghsa · osvUS
yauzl (aka Yet Another Unzip Library) version 3.2.0 for Node.js contains an off-by-one error in the NTFS extended timestamp extra field parser within the getLastModDate() function. The while loop condition checks cursor < data.length + 4 instead of cursor + 4 <= data.length, allowing readUInt16LE() to read past the buffer boundary. A remote attacker can cause a denial of service (process crash via ERR_OUT_OF_RANGE exception) by sending a crafted zip file with a malformed NTFS extra field. This affects any Node.js application that processes zip file uploads and calls entry.getLastModDate() on parsed entries. Fixed in version 3.2.1.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (13)
External citations — patches, advisories, analysis.
- https://github.com/thejoshwolfe/yauzlPatchcnnvd
- https://github.com/thejoshwolfe/yauzl/commit/c4695215b05c6adffda613b9051a2a85429b33fecnnvd
- https://www.codeant.ai/security-research/yauzl-denial-of-service-zip-file-crashcnnvd
- https://www.npmjs.com/package/yauzlcnnvd
- https://www.vulncheck.com/advisories/yauzl-denial-of-service-via-off-by-one-error-in-ntfs-timestamp-parsercnnvd
- https://github.com/thejoshwolfe/yauzl/commit/c4695215b05c6adffda613b9051a2a85429b33feenisa_euvd
- https://www.codeant.ai/security-research/yauzl-denial-of-service-zip-file-crashenisa_euvd
- https://www.npmjs.com/package/yauzlenisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan