Description
yauzl (aka Yet Another Unzip Library) version 3.2.0 for Node.js contains an off-by-one error in the NTFS extended timestamp extra field parser within the getLastModDate() function. The while loop condition checks cursor < data.length + 4 instead of cursor + 4 <= data.length, allowing readUInt16LE() to read past the buffer boundary. A remote attacker can cause a denial of service (process crash via ERR_OUT_OF_RANGE exception) by sending a crafted zip file with a malformed NTFS extra field. This affects any Node.js application that processes zip file uploads and calls entry.getLastModDate() on parsed entries. Fixed in version 3.2.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| thejoshwolfe | yauzl | 3.2.0 – < 3.2.1 | 3.2.1 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | node-yauzl | No fix yet | — |
| Ubuntu 26.04 LTS | node-yauzl | No fix yet | — |
| Ubuntu 25.10 | node-yauzl | No fix yet | — |
| Ubuntu 24.04 LTS | node-yauzl | No fix yet | — |
| Ubuntu 22.04 LTS | node-yauzl | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | node-yauzl | No fix yet | — |
| Ubuntu 18.04 LTS | node-yauzl | No fix yet | — |
| Ubuntu 16.04 LTS | node-yauzl | No fix yet | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | code-server | 4.110.1-r1 | — |
| Wolfi rolling | opensearch-dashboards-3 | 3.5.0-r8 | — |
| Wolfi rolling | renovate | 43.77.0-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | yauzl | >= 3.2.0, < 3.2.1 | 3.2.1 | GHSA-gmq8-994r-jv83 |
Advisories 1
- WID-SEC-2026-1220 IBM App Connect Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 7, 2026
References
- Patch Commit patch
- CodeAnt AI Security Research Advisory third-party-advisory
- npm - yauzl product
- VulnCheck Advisory: yauzl 3.2.0 - Denial of Service via Off-by-One Error in NTFS Timestamp Parser third-party-advisory