---
title: "GHSA-gmq8-994r-jv83: yauzl contains an off-by-one error"
description: "Moderate severity. yauzl contains an off-by-one error. Affects yauzl; fixed in 3.2.1."
url: https://inlinr.com/advisories/GHSA-gmq8-994r-jv83
lang: en
---

[Packages](https://inlinr.com/packages) / [yauzl](https://inlinr.com/packages/yauzl) / [Security](https://inlinr.com/packages/yauzl/security)

Moderate Vulnerability GHSA-gmq8-994r-jv83 CVE-2026-31988 Published 12 Mar 2026

# yauzl contains an off-by-one error

Your version 

Affected releases · [yauzl](https://inlinr.com/packages/yauzl)

- 3.x 3.2.0 Fixed in 3.2.1

On 3.x, the newest line:

```
npm install yauzl@3.2.1
```

Every release on a timeline

1. Not affected

0.0.0 – 3.1.3  
30 releases
2. Affected

3.2.0  
1 release
3. Fixed

3.2.1 – 3.4.0  
5 releases, latest

36 stable releases of yauzl, oldest to newest.

## What happens

yauzl (aka Yet Another Unzip Library) version 3.2.0 for Node.js contains an off-by-one error in the NTFS extended timestamp extra field parser within the getLastModDate() function. The while loop condition checks cursor < data.length + 4 instead of cursor + 4 <= data.length, allowing readUInt16LE() to read past the buffer boundary. A remote attacker can cause a denial of service (process crash via ERR\_OUT\_OF\_RANGE exception) by sending a crafted zip file with a malformed NTFS extra field. This affects any Node.js application that processes zip file uploads and calls entry.getLastModDate() on parsed entries. Fixed in version 3.2.1.

## How it is exploited

Exploitable over the network, with no account and no action from a user.

- **Confidentiality**: none
- **Integrity**: none
- **Availability**: low

CVSS:3.1/​AV:N/​AC:L/​PR:N/​UI:N/​S:U/​C:N/​I:N/​A:L

## References

- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-31988 "https://nvd.nist.gov/vuln/detail/CVE-2026-31988")  
nvd.nist.gov/vuln/detail/CVE-2026-31988
- [Fix commit](https://github.com/thejoshwolfe/yauzl/commit/c4695215b05c6adffda613b9051a2a85429b33fe "https://github.com/thejoshwolfe/yauzl/commit/c4695215b05c6adffda613b9051a2a85429b33fe")  
c469521
- [Package](https://github.com/thejoshwolfe/yauzl "https://github.com/thejoshwolfe/yauzl")  
github.com/thejoshwolfe/yauzl
- [Reference](https://www.codeant.ai/security-research/yauzl-denial-of-service-zip-file-crash "https://www.codeant.ai/security-research/yauzl-denial-of-service-zip-file-crash")  
codeant.ai/security-research/yauzl-denial-of-se…
- [Reference](https://www.npmjs.com/package/yauzl "https://www.npmjs.com/package/yauzl")  
npmjs.com/package/yauzl
- [Reference](https://www.vulncheck.com/advisories/yauzl-denial-of-service-via-off-by-one-error-in-ntfs-timestamp-parser "https://www.vulncheck.com/advisories/yauzl-denial-of-service-via-off-by-one-error-in-ntfs-timestamp-parser")  
vulncheck.com/advisories/yauzl-denial-of-servic…