Executive brief
yauzl is a popular Node.js library for reading ZIP files. The library contains an off-by-one error in its timestamp parsing code that allows an attacker to crash applications by sending a malicious ZIP file. Any Node.js application that processes untrusted ZIP uploads could be affected.
Technical details
yauzl version 3.2.0 contains an off-by-one error (CWE-193) in the NTFS extended timestamp extra field parser within the getLastModDate() function. The vulnerable while loop condition checks `cursor < data.length + 4` instead of `cursor + 4 <= data.length`, allowing readUInt16LE() to read past the allocated buffer boundary. A remote attacker can trigger a denial of service by providing a crafted ZIP file with a malformed NTFS extra field, causing the application to crash with an ERR_OUT_OF_RANGE exception. The vulnerability requires no authentication or user interaction beyond processing the file. The issue is fixed in version 3.2.1.
Affected products
- yauzl yauzl 3.2.0
Timeline
- 2026-03-12: disclosed
- 2026-03-13: patched: Version 3.2.1 released with fix
- 2026-03-11: advisory: NVD published