GHSA-gmq8-994r-jv83 CVE-2026-31988

yauzl contains an off-by-one error

Medium npm

Severity: 6.9 / 10; Medium · CVSS 4.0
Exploit chance (EPSS): 0.52%; Chance of exploitation in the next 30 days. Higher than 43.89% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-193 Off-by-one Error
Fix: 3.2.1; Upgrade yauzl to this version or later

Description

yauzl (aka Yet Another Unzip Library) version 3.2.0 for Node.js contains an off-by-one error in the NTFS extended timestamp extra field parser within the getLastModDate() function. The while loop condition checks cursor < data.length + 4 instead of cursor + 4 <= data.length, allowing readUInt16LE() to read past the buffer boundary. A remote attacker can cause a denial of service (process crash via ERR_OUT_OF_RANGE exception) by sending a crafted zip file with a malformed NTFS extra field. This affects any Node.js application that processes zip file uploads and calls entry.getLastModDate() on parsed entries. Fixed in version 3.2.1.

Affected versions

npm

Package	Vulnerable	Fixed in
yauzl	1 listed versions	No fix yet
yauzl	`>= 3.2.0, < 3.2.1`	`3.2.1`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

yauzl npm → `3.2.1`

npm

npm install yauzl@3.2.1

yarn

yarn add yauzl@3.2.1

pnpm

pnpm add yauzl@3.2.1

Severity breakdown

CVSS 4.0 6.9

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Attack vector: Network
Attack complexity: Low
Attack requirements: None
Privileges required: None
User interaction: None
Confidentiality (vulnerable system): None
Integrity (vulnerable system): None
Availability (vulnerable system): Low
Confidentiality (subsequent systems): None
Integrity (subsequent systems): None
Availability (subsequent systems): None

CVSS 3.1 5.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: Low

Weakness

CWE-193: Off-by-one Error

A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.

How to prevent it

Implementation: When copying character arrays or using character manipulation methods, the correct size parameter must be used to account for the null terminator that needs to be added at the end of the array. Some examples of functions susceptible to this weakness in C include strcpy(), strncpy(), strcat(), strncat(), printf(), sprintf(), scanf() and sscanf().

References

Advisories

Fixes and patches

github.com/thejoshwolfe/yauzl/commit/c4695215b05c6adffda613b9051a2a85429b33fe

Packages

github.com/thejoshwolfe/yauzl

Timeline

Mar 11, 2026 Published
Sep 10, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-q97c-p368-75c4 vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS)	Medium	Same weakness, CWE-193
GHSA-v859-c572-qh5p ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletions	Medium	Same weakness, CWE-193
GHSA-hwf3-r46v-5ggx ImageMagick: Information Disclosure when printing profiles with debug enabled	Low	Same weakness, CWE-193
GHSA-4565-r4x7-hg8j Gogs Vulnerable to Privilege Escalation via Collaboration Access Mode Validation	Medium	Same weakness, CWE-193
GHSA-jqq5-8px3-9m6m ImageMagick: Heap Buffer Over-Write in json and yaml encoder of a single byte due to incorrect fix	Medium	Same weakness, CWE-193
GHSA-533m-3wf6-c33v ImageMagick: Heap Buffer Over-Write of a single byte in the JP2 encoder.	Medium	Same weakness, CWE-193
GHSA-cr6r-hmj8-pr7r ImageMagick: Out-of-Bounds Read of a single byte in meta encoder	Medium	Same weakness, CWE-193
GHSA-q8h3-jv9v-57qx ImageMagick has has an off-by-one origin validation in allows out-of-bounds read in morphology processing	Medium	Same weakness, CWE-193

Credits: adalinesimonian

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor