CVE-2026-31808: file-type Package Experiences Denial of Service Due to Infinite Loop in ASF Parser

Background

The file-type package is a widely used Node.js library that detects the type of files based on their binary signatures. It supports various file formats, including images, audio, and video files. This package is essential for applications that need to handle file uploads or process files based on their types. However, it is vulnerable to a denial of service attack when parsing malformed ASF files, specifically when the sub-header has a zero-size field.

Vulnerability Detail

A denial of service vulnerability exists in the ASF (WMV/WMA) file type detection parser within the file-type package. When the parser processes a crafted input where an ASF sub-header has a 'size' field of zero, it enters an infinite loop. This occurs because the 'payload' value becomes negative (-24), causing the tokenizer to move the read position backwards, resulting in the same sub-header being read repeatedly. Any application utilizing file-type to detect untrusted or attacker-controlled input is susceptible to this issue, allowing an attacker to stall the Node.js event loop with a minimal payload of 55 bytes.

npm install file-type@22.2.0

npm install file-type@21.3.1

Workaround

As a temporary measure, you can validate or limit the size of input buffers before passing them to the file-type parser. Additionally, consider running file type detection in a worker thread with a timeout to prevent the main event loop from being stalled. Here is an example of how to implement a timeout in a worker thread:

const { Worker } = require('worker_threads');

function detectFileType(buffer) {
  return new Promise((resolve, reject) => {
    const worker = new Worker('./fileTypeWorker.js', { workerData: buffer });
    worker.on('message', resolve);
    worker.on('error', reject);
    worker.on('exit', (code) => {
      if (code !== 0) {
        reject(new Error(`Worker stopped with exit code ${code}`));
      }
    });
    setTimeout(() => {
      worker.terminate();
      reject(new Error('File type detection timed out'));
    }, 5000); // 5 seconds timeout
  });
}

Conclusion

The file-type package has a significant vulnerability (CVE-2026-31808) that can lead to denial of service due to an infinite loop in its ASF parser. Users are strongly encouraged to upgrade to version 21.3.1 or later to protect their applications. Implementing workarounds can also help mitigate the risks until an upgrade is feasible.

See every vulnerability recorded for file-type →

FAQ