CVE-2026-106070: Node.js ZipFile returns attacker-controlled prefix bytes after failed ZIP header validation

Q: What capability must an attacker have to exploit this issue?

The attacker must be able to provide ZIP data to a Node.js application using ZipFile and cause ZIP header validation to fail. The affected behavior can then return prefix bytes controlled by that ZIP data.

Q: Which release information should be reviewed for remediation?

The supplied references include the Node.js October 2026 security releases announcement and the Node.js v26.12.1 release information. The provided data does not identify other fixed versions.

Published Oct 21, 2026

Updated

Affected Software

1 affected componentFixes available

Node.js Node.js>=26.0.0<26.12.1

26.12.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 26.12.1

Event History

Oct 21, 2026

CVE Published

via Node.js·10:39 AM

Data Sourced

via Node.js·10:39 AM

SeverityAffected Software

Data Sourced

via Node.js·10:00 PM

Description

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

What capability must an attacker have to exploit this issue?

The attacker must be able to provide ZIP data to a Node.js application using ZipFile and cause ZIP header validation to fail. The affected behavior can then return prefix bytes controlled by that ZIP data.

Which release information should be reviewed for remediation?

The supplied references include the Node.js October 2026 security releases announcement and the Node.js v26.12.1 release information. The provided data does not identify other fixed versions.

CVE-2026-106070: Node.js ZipFile returns attacker-controlled prefix bytes after failed ZIP header validation

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

What capability must an attacker have to exploit this issue?

Which release information should be reviewed for remediation?

Company

Resources

Contact

Frequently Asked Questions

What capability must an attacker have to exploit this issue?

Which release information should be reviewed for remediation?