Packages / file-type / Security

ModerateVulnerabilityGHSA-5v7r-6r5c-r473CVE-2026-31808Published 10 Mar 2026

file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-header

Your version

Affected releases · file-type

  • 21.x21.0.0 – 21.3.0Fixed in 21.3.1
  • 20.x and older13.0.0 – 20.5.0No fix, no longer updated

On 21.x, the newest line:

npm install file-type@21.3.1
Every release on a timeline
22.x

  1. Not affected

    22.0.0 – 22.2.0

    6 releases, latest

21.x

  1. Affected

    21.0.0 – 21.3.0

    5 releases

  2. Fixed

    21.3.1 – 21.3.4

    4 releases

20.x

  1. Affected

    20.0.0 – 20.5.0

    8 releases

19.x

  1. Affected

    19.0.0 – 19.6.0

    9 releases

18.x

  1. Affected

    18.0.0 – 18.7.0

    9 releases

17.x

  1. Affected

    17.0.0 – 17.1.6

    10 releases

16.x

  1. Affected

    16.0.0 – 16.5.4

    11 releases

15.x

  1. Affected

    15.0.0 – 15.0.1

    2 releases

14.x

  1. Affected

    14.0.0 – 14.7.1

    15 releases

13.x

  1. Affected

    13.0.0 – 13.1.2

    7 releases

173 stable releases of file-type, oldest to newest, one row per major.

What happens

Impact

A denial of service vulnerability exists in the ASF (WMV/WMA) file type detection parser. When parsing a crafted input where an ASF sub-header has a size field of zero, the parser enters an infinite loop. The payload value becomes negative (-24), causing tokenizer.ignore(payload) to move the read position backwards, so the same sub-header is read repeatedly forever.

Any application that uses file-type to detect the type of untrusted/attacker-controlled input is affected. An attacker can stall the Node.js event loop with a 55-byte payload.

Patches

Fixed in version 21.3.1. Users should upgrade to >= 21.3.1.

Workarounds

Validate or limit the size of input buffers before passing them to file-type, or run file type detection in a worker thread with a timeout.

References

Reporter

crnkovic@lokvica.com