CVE-2026-31988

Name	CVE-2026-31988
Description	yauzl (aka Yet Another Unzip Library) version 3.2.0 for Node.js contains an off-by-one error in the NTFS extended timestamp extra field parser within the getLastModDate() function. The while loop condition checks cursor < data.length + 4 instead of cursor + 4 <= data.length, allowing readUInt16LE() to read past the buffer boundary. A remote attacker can cause a denial of service (process crash via ERR_OUT_OF_RANGE exception) by sending a crafted zip file with a malformed NTFS extra field. This affects any Node.js application that processes zip file uploads and calls entry.getLastModDate() on parsed entries. Fixed in version 3.2.1.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
node-yauzl (PTS)	bullseye	2.10.0-2	fixed
	bookworm, forky, sid, trixie	2.10.0-4	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
node-yauzl	source	(unstable)	(not affected)

Notes

- node-yauzl <not-affected> (Vulnerable code introduced later)
Introduced by: https://github.com/thejoshwolfe/yauzl/commit/421c51f0b2e8ef2c80e390e6d17957fba65c6b34 (3.2.0)
Fixed by: https://github.com/thejoshwolfe/yauzl/commit/00c561b8cf1ff92e076f7087ac6287e510d4af54 (3.2.1)
https://www.codeant.ai/security-research/yauzl-denial-of-service-zip-file-crash