Skip to main content

Improper Handling of Highly Compressed Data (Data Amplification) in file-type

CVE-2026-32630

  • file-type
  • org.webjars.npm:file-type
Medium
5.3/10

Summary

file-type detects the file type of a file, stream, or data. In versions 20.0.0 through 21.3.1, a crafted ZIP file can trigger excessive memory growth during type detection in file-type when using "fileTypeFromBuffer()", "fileTypeFromBlob()", or "fileTypeFromFile()". The ZIP inflate output limit is enforced for stream-based detection, but not for known-size inputs. As a result, a small compressed ZIP can cause file-type to inflate and process a much larger payload while probing ZIP-based formats such as OOXML. This vulnerability is fixed in 21.3.2.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • LOW

CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)

The software does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

References

Advisory Timeline

  • Published