CVE-2026-32630mediumCWE-409

CVE-2026-32630: fallo de gravedad media en sindresorhus file-type

file-type affected by ZIP Decompression Bomb DoS via [Content_Types].xml entry

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear file-type+ Monitorear file-type

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.3epss 0.3%
file-type detects the file type of a file, stream, or data. From 20.0.0 to 21.3.1, a crafted ZIP file can trigger excessive memory growth during type detection in file-type when using fileTypeFromBuffer(), fileTypeFromBlob(), or fileTypeFromFile(). The ZIP inflate output limit is enforced for stream-based detection, but not for known-size inputs. As a result, a small compressed ZIP can cause file-type to inflate and process a much larger payload while probing ZIP-based formats such as OOXML. This vulnerability is fixed in 21.3.2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Productos afectados
sindresorhus · file-type
CVEs relacionadas — sindresorhus file-type

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-31808MEDIUMfile-type affected by infinite loop in ASF parser on malformed input with zero-size sub-headerEPSS 0.4%