Node.js ZipFile returns wrong bytes after header validation fails
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Deferred Red Hat: fix deferred
Attack profile from CVSS 3.0 · CNA. Fix status from CNA and Red Hat.
Summary
Node.js 26.12.0 is affected by a flaw in the zlib.ZipFile API. When an archive's local header does not match its central directory, a later content read returns attacker-controlled bytes from the start of the file instead of rejecting the archive (CWE-840). A remote attacker can make a Node.js-based scanner approve content that differs from what another ZIP implementation extracts from the same archive, with low integrity impact.
Written with Claude Haiku 5.5 from the sources below · 2026-11-02
Description from the CNA
A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails. When `zipEntry.modified` is read on an archive whose local header does not match its central directory, either directly or while compacting the archive, the validation error is caught but the parsed local header is left cached without a content offset. A later content read then returns attacker-controlled bytes from the start of the file instead of rejecting the archive, and CRC-32 verification still passes because the attacker controls the central directory CRC. A Node.js-based scanner can therefore approve different content from what another ZIP implementation extracts from the same archive. This vulnerability affects Node.js **26.x**.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for node. Red Hat lists Red Hat Enterprise Linux 10 and Red Hat Enterprise Linux 9 as affected without a fix and has no plan available.
Written with Claude Haiku 5.5 from the sources below · 2026-11-02
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
Not affected: 4 products
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Hardened Images
Timeline
- 2026-10-23 Threatist record created from CVE-2026-106070
- 2026-10-26 Affected versions changed · Red Hat
- 2026-10-26 CVSS score added · Red Hat
- 2026-10-26 Affected versions changed · Red Hat
- 2026-11-02 CISA SSVC decision points changed
More NodeJS vulnerabilities
- TI-2026-79288 Out-of-bounds write in Google Brotli decoder KEVCVSS 4.0CRITICAL 9.2
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2024-18584 Race condition in NodeJS Node CVSS 3.0HIGH 8.2
- TI-2016-01993 The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other… CVSS 3.1HIGH 7.5
- TI-2024-03325 Command injection vulnerability in programing languages on Microsoft Windows operating system. CVSS 3.1CRITICAL 9.8
- TI-2022-03472 X.509 Email Address Variable Length Buffer Overflow CVSS 3.1HIGH 7.5
Sources
- CVE-2026-106070 · CVE Program
- CVE-2026-106070 · NVD
- FIRST EPSS
- CVE-2026-106070 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences