CVE-2026-106070: Node.js ZipFile returns attacker-controlled prefix bytes after failed ZIP header validation
A flaw in the Node.js zlib.ZipFile API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails. When zipEntry.modified is read on an archive whose local header does not match its central directory, either directly or while compacting the archive, the validation error is caught but the parsed local header is left cached without a content offset. A later content read then returns attacker-controlled bytes from the start of the file instead of rejecting the archive, and CRC-32 verification still passes because the attacker controls the central directory CRC. A Node.js-based scanner can therefore approve different content from what another ZIP implementation extracts from the same archive. This vulnerability affects Node.js 26.x.
Other sources
A flaw in the Node.js zlib.ZipFile API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails.
When zipEntry.modified is read on an archive whose local header does not match its central directory, either directly or while compacting the archive, the validation error is caught but the parsed local header is left cached without a content offset. A later content read then returns attacker-controlled bytes from the start of the file instead of rejecting the archive, and CRC-32 verification still passes because the attacker controls the central directory CRC. A Node.js-based scanner can therefore approve different content from what another ZIP implementation extracts from the same archive.
— Node.Js
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 26.12.1 - Upgrade
Upgrade
bitnami/nodeto a version that resolves this vulnerability.Fixed in 26.12.1 - Upgrade
Upgrade
bitnami/node-minto a version that resolves this vulnerability.Fixed in 26.12.1 - Upgrade
Upgrade
debian/nodejsto a version that resolves this vulnerability.Fixed in 18.20.4+dfsg-1~deb12u2Fixed in 18.20.4+dfsg-1~deb12u3Fixed in 20.19.2+dfsg-1+deb13u2Fixed in 20.19.2+dfsg-1+deb13u3Fixed in 24.21.0+dfsg+~cs24.13.4-1Fixed in 24.22.2+dfsg+~cs24.19.2-1 - Upgrade
Upgrade
alpine/nodejsto a version that resolves this vulnerability.Fixed in 24.22.1-r0 - Upgrade
Upgrade
alpine/nodejs-currentto a version that resolves this vulnerability.Fixed in 26.12.1-r0
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What capability must an attacker have to exploit this issue?
The attacker must be able to provide ZIP data to a Node.js application using ZipFile and cause ZIP header validation to fail. The affected behavior can then return prefix bytes controlled by that ZIP data.
Which release information should be reviewed for remediation?
The supplied references include the Node.js October 2026 security releases announcement and the Node.js v26.12.1 release information. The provided data does not identify other fixed versions.