GHSA-gmq8-994r-jv83

yauzl contains an off-by-one error

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-31988

Packages

Ecosystem	Package	Affected	Fixed in
npm	yauzl	>= 3.2.0, < 3.2.1	3.2.1

Details

As written in the advisory (Markdown source, shown as plain text).

yauzl (aka Yet Another Unzip Library) version 3.2.0 for Node.js contains an off-by-one error in the NTFS extended timestamp extra field parser within the getLastModDate() function. The while loop condition checks cursor < data.length + 4 instead of cursor + 4 <= data.length, allowing readUInt16LE() to read past the buffer boundary. A remote attacker can cause a denial of service (process crash via ERR_OUT_OF_RANGE exception) by sending a crafted zip file with a malformed NTFS extra field. This affects any Node.js application that processes zip file uploads and calls entry.getLastModDate() on parsed entries. Fixed in version 3.2.1.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2026-31988 advisory
https://github.com/thejoshwolfe/yauzl/commit/c4695215b05c6adffda613b9051a2a85429b33fe web
https://github.com/thejoshwolfe/yauzl package
https://www.codeant.ai/security-research/yauzl-denial-of-service-zip-file-crash web
https://www.npmjs.com/package/yauzl web
https://www.vulncheck.com/advisories/yauzl-denial-of-service-via-off-by-one-error-in-ntfs-timestamp-parser web