Skip to main content

Off-by-one Error

CVE-2026-31988

Medium
6.9/10

Summary

yauzl (aka Yet Another Unzip Library) version 3.2.0 for Node.js contains an off-by-one error in the NTFS extended timestamp extra field parser within the "getLastModDate()" function. The while loop condition checks "cursor < data.length + 4" instead of "cursor + 4 <= data.length", allowing "readUInt16LE()" to read past the buffer boundary. A remote attacker can cause a Denial of Service (process crash via ERR_OUT_OF_RANGE exception) by sending a crafted zip file with a malformed NTFS extra field. This affects any Node.js application that processes zip file uploads and calls "entry.getLastModDate()" on parsed entries. Fixed in version 3.2.1.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • LOW

CWE-193 - Off-by-one Error

A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.

References

Advisory Timeline

  • Published