Packages / yauzl / Security

ModerateVulnerabilityGHSA-gmq8-994r-jv83CVE-2026-31988Published 12 Mar 2026

yauzl contains an off-by-one error

Your version

Affected releases · yauzl

  • 3.x3.2.0Fixed in 3.2.1

On 3.x, the newest line:

npm install yauzl@3.2.1
Every release on a timeline

  1. Not affected

    0.0.0 – 3.1.3

    30 releases

  2. Affected

    3.2.0

    1 release

  3. Fixed

    3.2.1 – 3.4.0

    5 releases, latest

36 stable releases of yauzl, oldest to newest.

What happens

yauzl (aka Yet Another Unzip Library) version 3.2.0 for Node.js contains an off-by-one error in the NTFS extended timestamp extra field parser within the getLastModDate() function. The while loop condition checks cursor < data.length + 4 instead of cursor + 4 <= data.length, allowing readUInt16LE() to read past the buffer boundary. A remote attacker can cause a denial of service (process crash via ERR_OUT_OF_RANGE exception) by sending a crafted zip file with a malformed NTFS extra field. This affects any Node.js application that processes zip file uploads and calls entry.getLastModDate() on parsed entries. Fixed in version 3.2.1.