CVE-2022-36313: file-type vulnerable to Infinite Loop via malformed MKV file
Summary
CVE-2022-36313: file-type vulnerable to Infinite Loop via malformed MKV file. Affects file-type across 2 version ranges.
>= 13.0.0, < 16.5.4
>= 17.0.0, < 17.1.3
Fixed in 16.5.4 or 17.1.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The file-type package is an npm package used in Node.js applications to detect the file type of a given file. It provides functionality to identify the file type based on its content and file extension. This package is widely used in web servers and other applications that handle file uploads and processing. However, versions 13.0.0 until 16.5.4 and 17.x before 17.1.3 of the file-type package are vulnerable to an issue that can cause an infinite loop when processing a malformed MKV file. This vulnerability can lead to the application becoming unresponsive and potentially be exploited for a denial-of-service (DoS) attack on a web server.
Vulnerability Detail
The vulnerability in the file-type package arises from a flaw in the file type detector when handling malformed MKV (Matroska) files. When a malformed MKV file is encountered, the file type detector gets caught in an infinite loop, causing the application to become unresponsive. This vulnerability can be exploited by an attacker to launch a DoS attack on a web server by uploading a specially crafted MKV file. The impact of this vulnerability is a loss of service availability. The Common Vulnerability Scoring System (CVSS) score for this vulnerability is 7.5, indicating a high severity.
How To Fix
Latest published version: 22.2.0 as of 23 Oct 2026
npm install file-type@22.2.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 13.0.0, < 16.5.416.5.4npm install file-type@16.5.4 -
>= 17.0.0, < 17.1.317.1.3npm install file-type@17.1.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, if updating the file-type package is not immediately feasible, it is recommended to implement file type validation and filtering on the server-side before processing any uploaded files. This can be done by checking the file extension and using other file type detection mechanisms to ensure that only valid files are processed. By implementing this workaround, the risk of encountering a malformed MKV file and triggering the vulnerability can be mitigated.
Conclusion
The file-type package in versions 13.0.0 until 16.5.4 and 17.x before 17.1.3 is vulnerable to an infinite loop issue when processing malformed MKV files. This can lead to the application becoming unresponsive and potentially be exploited for a denial-of-service attack. To mitigate this vulnerability, it is recommended to update the file-type package to the fixed versions. Implementing file type validation and filtering on the server-side can also provide a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for file-type →
FAQ
The file-type package is an npm package used in Node.js applications to detect the file type of a given file.
The impact of this vulnerability is a loss of service availability, as the application becomes unresponsive when processing a malformed MKV file.
To fix this vulnerability, update the file-type package to version 16.5.4 or higher (for versions 13.0.0 until 16.5.4) or version 17.1.3 or higher (for versions 17.x).
Yes, a temporary workaround is to implement file type validation and filtering on the server-side to mitigate the risk of encountering a malformed MKV file.
The CVSS score for this vulnerability is 7.5, indicating a high severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for file-type.
