Free AI Safety Workshop — in collaboration with explainx.aiSave your seat
AgentbeamBeta
Open-source package vulnerability · Node.js

CVE-2026-106070: Node.js ZipFile returns attacker-controlled prefix bytes after failed ZIP header validation

low

The lazy file-backed ZIP resolver in the Node.js zlib module cached a parsed local header before checking it against the central directory. A failed check left the entry with a cached header and an unresolved content offset, so a later read could use the file descriptor's current position and return attacker-controlled bytes.

Published Oct 21, 2026

Advisory details

From the National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.

The lazy file-backed ZIP resolver in the Node.js zlib module cached a parsed local header before checking it against the central directory. A failed check left the entry with a cached header and an unresolved content offset, so a later read could use the file descriptor's current position and return attacker-controlled bytes. The fix validates the local header and calculates its content offset before committing either value. Affected: Node.js 26.x before 26.12.1. Fixed in Node.js 26.12.1, released October 21, 2026.

Credited to startimeash.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

Coverage on the Beam blog

More Node.js vulnerabilities

All Node.js entries