When `zipEntry.modified` is read on an archive whose local header does not match its central directory, either directly or while compacting the archive, the validation error is caught but the parsed local header is left cached without a content offset. A later content read then returns attacker-controlled bytes from the start of the file instead of rejecting the archive, and CRC-32 verification still passes because the attacker controls the central directory CRC. A Node.js-based scanner can therefore approve different content from what another ZIP implementation extracts from the same archive.
This vulnerability affects Node.js **26.x**.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
No data.
No advisories yet.
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
Fri, 23 Oct 2026 18:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Node.js zlib.ZipFile Header Validation Flaw Exposes Attacker-Controlled Data |
Fri, 23 Oct 2026 16:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails. When `zipEntry.modified` is read on an archive whose local header does not match its central directory, either directly or while compacting the archive, the validation error is caught but the parsed local header is left cached without a content offset. A later content read then returns attacker-controlled bytes from the start of the file instead of rejecting the archive, and CRC-32 verification still passes because the attacker controls the central directory CRC. A Node.js-based scanner can therefore approve different content from what another ZIP implementation extracts from the same archive. This vulnerability affects Node.js **26.x**. | |
| Weaknesses | CWE-840 | |
| References |
| |
| Metrics |
cvssV3_0
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: hackerone
Published:
Updated: 2026-10-23T16:15:05.741Z
Reserved: 2026-10-06T15:00:00.655Z
Link: CVE-2026-106070
Vulnrichment
No data.
NVD
Status : Awaiting Analysis
Published: 2026-10-23T17:17:19.917
Modified: 2026-10-23T19:42:24.553
Link: CVE-2026-106070
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-10-23T18:00:15Z