Packages / file-type / Security

HighVulnerabilityGHSA-mhxj-85r3-2x55CVE-2022-36313Published 22 Jul 2022

file-type vulnerable to Infinite Loop via malformed MKV file

Your version

Affected releases · file-type

  • 17.x17.0.0 – 17.1.2Fixed in 17.1.3
  • 16.x16.0.0 – 16.5.3Fixed in 16.5.4
  • 15.x and older13.0.0 – 15.0.1No fix, no longer updated

On 17.x, the newest line:

npm install file-type@17.1.3
Every release on a timeline
22.x

  1. Not affected

    22.0.0 – 22.2.0

    6 releases, latest

17.x

  1. Affected

    17.0.0 – 17.1.2

    6 releases

  2. Fixed

    17.1.3 – 17.1.6

    4 releases

16.x

  1. Affected

    16.0.0 – 16.5.3

    10 releases

  2. Fixed

    16.5.4

    1 release

15.x

  1. Affected

    15.0.0 – 15.0.1

    2 releases

14.x

  1. Affected

    14.0.0 – 14.7.1

    15 releases

13.x

  1. Affected

    13.0.0 – 13.1.2

    7 releases

173 stable releases of file-type, oldest to newest, one row per major.

What happens

An issue was discovered in the file-type package from 13.0.0 until 16.5.4 and 17.x before 17.1.3 for Node.js. A malformed MKV file could cause the file type detector to get caught in an infinite loop. This would make the application become unresponsive and could be used to cause a DoS attack when used on a web server.