CVE-2026-106070
published 2026-10-23CVE-2026-106070: A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation…
PriorityP416low3.7CVSS 3.0
AVNACHPRNUINSUCNILAN
EPSS
0.35%
28.0th percentile
A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails.
When `zipEntry.modified` is read on an archive whose local header does not match its central directory, either directly or while compacting the archive, the validation error is caught but the parsed local header is left cached without a content offset. A later content read then returns attacker-controlled bytes from the start of the file instead of rejecting the archive, and CRC-32 verification still passes because the attacker controls the central directory CRC. A Node.js-based scanner can therefore approve different content from what another ZIP implementation extracts from the same archive.
This vulnerability affects Node.js **26.x**.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| nodejs | node | 26.12.0 – 26.12.0 | — |
| nodejs_26 | nodejs | — | — |
CVSS provenance
nvdv3.03.7LOWCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
vendor_redhat3.7LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Node.js 26.x ZipFile zlib.ZipFile information disclosure
vuldb·2026-10-23·CVSS 3.7
CVE-2026-106070 [LOW] Node.js 26.x ZipFile zlib.ZipFile information disclosure
A vulnerability was found in Node.js 26.x. It has been declared as problematic. Affected by this issue is the function zlib.ZipFile of the component ZipFile. Executing a manipulation can lead to information disclosure.
This vulnerability appears as CVE-2026-106070. The attack may be performed from remote. There is no available exploit.
GHSA
A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails.
ghsa_unreviewed·2026-10-23
CVE-2026-106070 [LOW] A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails.
A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails.
When `zipEntry.modified` is read on an archive whose local header does not match its central directory, either directly or while compacting the archive, the validation error is caught but the parsed local header is left cached without a content offset. A later content read then returns attacker-controlled bytes from the start of the file instead of rejecting the archive, and CRC-32 verification still passes because the attacker controls the central directory CRC. A Node.js-based scanner can therefore approve different content from what another ZIP implementation extracts from the same archive.
This vulnerability affects Node.
Red Hat
nodejs: Node.js: Security inspection bypass via crafted ZIP archive header mismatch
vendor_redhat·2026-10-23·CVSS 3.7
CVE-2026-106070 [LOW] CWE-754 nodejs: Node.js: Security inspection bypass via crafted ZIP archive header mismatch
nodejs: Node.js: Security inspection bypass via crafted ZIP archive header mismatch
A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails.
When `zipEntry.modified` is read on an archive whose local header does not match its central directory, either directly or while compacting the archive, the validation error is caught but the parsed local header is left cached without a content offset. A later content read then returns attacker-controlled bytes from the start of the file instead of rejecting the archive, and CRC-32 verification still passes because the attacker controls the central directory CRC. A Node.js-based scanner can therefore approve different content from what another
Fortinet
Multiple Node.js CVEs
vendor_fortinet·CVSS 6.5
CVE-2026-105482 [MEDIUM] Multiple Node.js CVEs
FG-IR-26-187: Multiple Node.js CVEs
CVSSv3 Score:
9.8
CVE-2026-105482 - (high)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-105483 - (high)This vulnerability affects Node.js 26.x and 24.x.CVE-2026-106069 - (high)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-111497 - (high)A flaw in Node.js can cause Node.js Brotli decoder out-of-bounds write permits remote code execution.This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-105481 - (medium)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-106072 - (medium)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-106074 - (medium)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-106070 - (low)This vulnerability affects Node.js 26.x.CVE-2026-106071 -
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-106070 nodejs26: Node.js: Security inspection bypass via crafted ZIP archive header mismatch [fedora-rawhide]
bugzilla·2026-10-26·CVSS 3.7
CVE-2026-106070 [LOW] CVE-2026-106070 nodejs26: Node.js: Security inspection bypass via crafted ZIP archive header mismatch [fedora-rawhide]
CVE-2026-106070 nodejs26: Node.js: Security inspection bypass via crafted ZIP archive header mismatch [fedora-rawhide]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails.
When `zipEntry.modified` is read on an archive whose local header does not match its central directory, either directly or while compacting the archive, the validation error is caught but the parsed local header is left cached without a content offset. A later content read then returns at
Bugzilla
CVE-2026-106070 nodejs: Node.js: Security inspection bypass via crafted ZIP archive header mismatch
bugzilla·2026-10-23·CVSS 3.7
CVE-2026-106070 [LOW] CVE-2026-106070 nodejs: Node.js: Security inspection bypass via crafted ZIP archive header mismatch
CVE-2026-106070 nodejs: Node.js: Security inspection bypass via crafted ZIP archive header mismatch
A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails.
When `zipEntry.modified` is read on an archive whose local header does not match its central directory, either directly or while compacting the archive, the validation error is caught but the parsed local header is left cached without a content offset. A later content read then returns attacker-controlled bytes from the start of the file instead of rejecting the archive, and CRC-32 verification still passes because the attacker controls the central directory CRC. A Node.js-based scanner can therefore approve different content f
2026-10-23
Published