PT-2026-24893 · Root+4 · @Rootio/Yauzl+2

Josh Wolfe + 1 · Published 2026-03-11 · Updated 2026-04-03 · CVE-2026-31988

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions yauzl version 3.2.0

Description yauzl, also known as Yet Another Unzip Library, version 3.2.0 for Node.js contains an off-by-one error within the getLastModDate() function, specifically in the NTFS extended timestamp extra field parser. The condition in a 'while' loop incorrectly checks cursor < data.length + 4 instead of cursor + 4 <= data.length, which allows the readUInt16LE() function to read beyond the buffer's boundaries. A remote attacker can exploit this by sending a specially crafted zip file containing a malformed NTFS extra field, leading to a denial of service and a process crash due to an ERR OUT OF RANGE exception. This impacts any Node.js application that processes zip file uploads and calls entry.getLastModDate() on the parsed entries.

Recommendations Update yauzl to version 3.2.1 or later.

Exploit

Fix

DoS

Weakness Enumeration

CWE-193

Related Identifiers

CVE-2026-31988

GHSA-GMQ8-994R-JV83

Affected Products

@Rootio/Yauzl

Node-Yauzl

Yauzl

References · 16

• 🔥 https://codeant.ai/security-research/yauzl-denial-of-service-zip-file-crash · Exploit
• https://github.com/thejoshwolfe/yauzl/commit/c4695215b05c6adffda613b9051a2a85429b33fe · Patch
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2026-31988 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-31988 · Security Note
• https://osv.dev/vulnerability/GHSA-gmq8-994r-jv83 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31988 · Security Note
• https://osv.dev/vulnerability/CVE-2026-31988 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31988 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-31988 · Vendor Advisory
• https://github.com/thejoshwolfe/yauzl · Note
• https://t.me/CVEtracker/47198 · Telegram Post
• https://vulncheck.com/advisories/yauzl-denial-of-service-via-off-by-one-error-in-ntfs-timestamp-parser · Note
• https://npmjs.com/package/yauzl · Note
• https://reddit.com/r/Charlotte_MCP/comments/1sbtscp/v060_released_batch_form_fills_mcpcompliant_tool · Reddit Post
• https://twitter.com/cyberbivash/status/2031902265787744651 · Twitter Post