Vulnerability · Published Mar 11, 2026 · Assigned by VulnCheck

CVE-2026-31988yauzl 3.2.0 - Denial of Service via Off-by-One Error in NTFS Timestamp Parser

Medium 5.3

In plain English

A medium-severity security flaw in yauzl from thejoshwolfe. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.6%top 52.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

yauzl (aka Yet Another Unzip Library) version 3.2.0 for Node.js contains an off-by-one error in the NTFS extended timestamp extra field parser within the getLastModDate() function. The while loop condition checks cursor < data.length + 4 instead of cursor + 4 <= data.length, allowing readUInt16LE() to read past the buffer boundary. A remote attacker can cause a denial of service (process crash via ERR_OUT_OF_RANGE exception) by sending a crafted zip file with a malformed NTFS extra field. This affects any Node.js application that processes zip file uploads and calls entry.getLastModDate() on parsed entries. Fixed in version 3.2.1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Ubuntu:22.04:LTS	node-yauzl	no fix listed	UBUNTU-CVE-2026-31988
Ubuntu:24.04:LTS	node-yauzl	no fix listed	UBUNTU-CVE-2026-31988
Ubuntu:25.10	node-yauzl	no fix listed	UBUNTU-CVE-2026-31988
Ubuntu:26.04:LTS	node-yauzl	no fix listed	UBUNTU-CVE-2026-31988
Ubuntu:26.10	node-yauzl	no fix listed	UBUNTU-CVE-2026-31988
npm	yauzl	3.2.1	GHSA-gmq8-994r-jv83

Affected products (as reported)

Vendor	Product	Versions
thejoshwolfe	yauzl	3.2.0 – before 3.2.1

Weakness: CWE-193 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

Patch Commit patch
CodeAnt AI Security Research Advisory third-party-advisory
npm - yauzl product
VulnCheck Advisory: yauzl 3.2.0 - Denial of Service via Off-by-One Error in NTFS Timestamp Parser third-party-advisory