Executive brief
The file-type npm package, which detects file types by analyzing file signatures, contains a denial-of-service vulnerability in its ASF (WMV/WMA) file format parser. When processing specially crafted malformed files, an attacker can trigger an infinite loop that freezes the entire Node.js application with just a 55-byte payload. This impacts any application using file-type to process untrusted user-supplied files.
Technical details
The vulnerability is a CWE-835 infinite loop condition in the ASF parser component of file-type. When parsing an ASF sub-header with a size field of zero, the payload calculation results in a negative value (-24), causing tokenizer.ignore(payload) to move the read position backwards instead of forwards. This causes the parser to re-read the same malformed sub-header indefinitely, starving the Node.js event loop. The vulnerability affects versions 13.0.0 through 21.3.0 of the npm file-type package. No authentication or privileges are required; an attacker only needs to provide a crafted 55-byte input file to a vulnerable application. The issue is fixed in version 21.3.1 via commit 319abf8. Workarounds include validating input buffer sizes or running file-type detection in a separate worker thread with a timeout.
Affected products
- Sindresorhus file-type >=13.0.0, <21.3.1
Timeline
- 2026-03-10: disclosed: Vulnerability published on GitHub Advisory Database and OSV
- 2026-03-10: patched: Fixed in version 21.3.1 with commit 319abf8