CVE-2026-31988: yauzl Off-by-One Error in NTFS Timestamp Parser
Summary
CVE-2026-31988: yauzl contains an off-by-one error. Affects yauzl versions < 3.2.1. Fixed in 3.2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
yauzl, or Yet Another Unzip Library, is a popular Node.js package designed for handling zip file operations. It allows developers to read and extract files from zip archives efficiently. The library is widely used in applications that require file uploads and processing, making it essential for many Node.js projects. However, a recent vulnerability has been identified that could lead to potential denial of service attacks.
Vulnerability Detail
The vulnerability arises from an off-by-one error in the NTFS extended timestamp extra field parser within the getLastModDate() function of yauzl version 3.2.0. The while loop condition incorrectly checks cursor < data.length + 4 instead of cursor + 4 <= data.length. This flaw allows the readUInt16LE() function to read beyond the buffer boundary, which can lead to a process crash due to an ERR_OUT_OF_RANGE exception. A remote attacker can exploit this vulnerability by sending a specially crafted zip file containing a malformed NTFS extra field, affecting any Node.js application that processes zip file uploads and calls entry.getLastModDate() on parsed entries.
How To Fix
Minimum fixed version
3.2.1
This is the first release that contains the fix.
npm install yauzl@3.2.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement input validation to check the integrity of zip files before processing them. This can help mitigate the risk of processing malicious zip files until you can update to the patched version.
Conclusion
The yauzl package has a vulnerability (CVE-2026-31988) that can lead to denial of service due to an off-by-one error in its timestamp parser. It is crucial to update to version 3.2.1 or later to safeguard your applications. Additionally, using tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for yauzl →
FAQ
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
The vulnerability affects yauzl version 3.2.0. Versions 3.2.1 and later have the issue fixed.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground at Vulert Scanner without needing to sign up.
If left unaddressed, this vulnerability could allow attackers to crash your application, leading to denial of service and potential data loss.
Yes, implementing input validation to check the integrity of zip files can help mitigate the risk until you can update to the patched version.
