PT-2026-24893 · Root+4 · @Rootio/Yauzl+2

Josh Wolfe + 1 · Publicado 2026-03-11 · Atualizado 2026-06-04 · CVE-2026-31988

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions yauzl version 3.2.0

Description yauzl, also known as Yet Another Unzip Library, version 3.2.0 for Node.js contains an off-by-one error within the getLastModDate() function, specifically in the NTFS extended timestamp extra field parser. The condition in a 'while' loop incorrectly checks cursor < data.length + 4 instead of cursor + 4 <= data.length, which allows the readUInt16LE() function to read beyond the buffer's boundaries. A remote attacker can exploit this by sending a specially crafted zip file containing a malformed NTFS extra field, leading to a denial of service and a process crash due to an ERR OUT OF RANGE exception. This impacts any Node.js application that processes zip file uploads and calls entry.getLastModDate() on the parsed entries.

Recommendations Update yauzl to version 3.2.1 or later.

Exploit

Correção

DoS

Enumeração de Fraquezas

CWE-193

Identificadores relacionados

CVE-2026-31988

GHSA-GMQ8-994R-JV83

Produtos afetados

@Rootio/Yauzl

Node-Yauzl

Yauzl

Referências · 16

• 🔥 https://codeant.ai/security-research/yauzl-denial-of-service-zip-file-crash · Exploit
• https://github.com/thejoshwolfe/yauzl · Nota
• https://github.com/thejoshwolfe/yauzl/commit/c4695215b05c6adffda613b9051a2a85429b33fe · Correção
• https://vulncheck.com/advisories/yauzl-denial-of-service-via-off-by-one-error-in-ntfs-timestamp-parser · Nota
• https://cve.org/CVERecord?id=CVE-2026-31988 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-gmq8-994r-jv83 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31988 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2026-31988 · Aviso do Fabricante
• https://t.me/CVEtracker/47198 · Publicação no Telegram
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2026-31988 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-31988 · Nota de Segurança
• https://reddit.com/r/Charlotte_MCP/comments/1sbtscp/v060_released_batch_form_fills_mcpcompliant_tool · Publicação no Reddit
• https://twitter.com/cyberbivash/status/2031902265787744651 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2031992361035973007 · Publicação no Twitter
• https://npmjs.com/package/yauzl · Nota