GitHub Advisoryadvisory · npm

GHSA-gmq8-994r-jv83 yauzl contains an off-by-one error

MEDIUM Published 2026-03-12 Modified 2026-03-16 Official page ↗
Aliases
CVE-2026-31988
Ecosystem
npm
Packages
yauzl
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-193
Reviewed
2026-03-13

Affected packages

• npm yauzl: >= 3.2.0, < 3.2.1 → fixed in 3.2.1

Description

yauzl (aka Yet Another Unzip Library) version 3.2.0 for Node.js contains an off-by-one error in the NTFS extended timestamp extra field parser within the getLastModDate() function. The while loop condition checks cursor < data.length + 4 instead of cursor + 4 <= data.length, allowing readUInt16LE() to read past the buffer boundary. A remote attacker can cause a denial of service (process crash via ERR_OUT_OF_RANGE exception) by sending a crafted zip file with a malformed NTFS extra field. This affects any Node.js application that processes zip file uploads and calls entry.getLastModDate() on parsed entries. Fixed in version 3.2.1.

Related

Alias · CVE (1)

  • CVE-2026-31988 yauzl (aka Yet Another Unzip Library) version 3.2.0 for Node.js contains an off-by-one error in the NTFS extended timestamp extra field… vulnerability

Weakness · CWE (1)

  • CWE-193 Off-by-one Error weakness

References