CVE-2026-106070 in Node.js
Summary
by MITRE • 10/23/2026
A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails.
When `zipEntry.modified` is read on an archive whose local header does not match its central directory, either directly or while compacting the archive, the validation error is caught but the parsed local header is left cached without a content offset. A later content read then returns attacker-controlled bytes from the start of the file instead of rejecting the archive, and CRC-32 verification still passes because the attacker controls the central directory CRC. A Node.js-based scanner can therefore approve different content from what another ZIP implementation extracts from the same archive.
This vulnerability affects Node.js **26.x**.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The identified vulnerability resides within the zlib module of Node.js, specifically affecting the ZipFile API in version 26.x. This flaw stems from an improper handling of validation errors during the parsing and extraction processes for ZIP archives. The core issue arises when a discrepancy exists between the local file header and the central directory entry of a ZIP archive. Under normal circumstances, such discrepancies should trigger a rejection of the archive or at least prevent access to corrupted data. However, due to this flaw, the validation error is caught internally but does not result in a clean failure state that prevents further processing. Instead, the parsed local header remains cached without a valid content offset, creating an inconsistent internal state within the Node.js runtime environment.
When subsequent operations attempt to read the content of a specific entry, particularly when accessing properties like zipEntry.modified or during archive compaction, the system relies on this corrupted cache entry. Because the content offset is missing or invalid, the retrieval logic fails to locate the correct data segment associated with the requested file entry. Instead of throwing an exception or returning null, the implementation defaults to reading from a fallback position, which often corresponds to the beginning of the underlying file buffer. This results in the return of arbitrary bytes that do not belong to the intended archive entry. These returned bytes are effectively attacker-controlled if the ZIP archive is crafted maliciously, as the attacker can manipulate the central directory and local headers to exploit this parsing logic gap.
The operational impact of this vulnerability is significant for applications relying on Node.js for file processing, particularly in security scanning or data validation contexts. A critical consequence is that a CRC-32 verification may still pass despite the returned content being incorrect. This occurs because the attacker can control the central directory's CRC value to match the arbitrary bytes read from the start of the file rather than the actual intended entry content. Consequently, integrity checks fail to detect the tampering or corruption. In scenarios where a Node.js-based scanner validates archives against other ZIP implementations, this discrepancy allows for silent data substitution. The scanner may approve an archive as valid based on its own flawed extraction logic, while another standard-compliant tool would reject it due to header mismatches, leading to potential security bypasses in automated pipelines or deployment systems that trust the Node.js validation output implicitly.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation and CWE-436 Interpretation Conflict. The root cause is an interpretation conflict where different parts of the ZIP specification are handled inconsistently by the parser, leading to divergent behaviors between implementations. In terms of attack vectors, this relates to ATT&CK technique T1587 Development of Capabilities, specifically in crafting malicious artifacts that exploit specific software vulnerabilities for evasion or code execution if combined with other flaws. The vulnerability allows an attacker to inject misleading data into the application's memory space through file input, which could potentially lead to further exploitation depending on how the returned bytes are processed by the host application.
Mitigation strategies must focus on immediate patching and defensive coding practices until updates are widely deployed. Users of Node.js 26.x should upgrade to a patched version as soon as it becomes available from the official distribution channels, ensuring that the internal state management for ZIP headers is corrected to properly reject archives with mismatched local and central directories. In the interim, applications processing untrusted ZIP files should implement additional validation layers outside of the native zlib module. This includes verifying archive integrity using external tools or libraries known for strict compliance with the PKZIP specification before passing data into Node.js processes. Furthermore, developers should avoid relying solely on CRC-32 checks provided by vulnerable implementations and instead perform independent verification of file contents against expected hashes or signatures to detect any discrepancies caused by this parsing flaw.