Executive brief
file-type is a popular Node.js library used to detect file types by analyzing file contents. A specially crafted ZIP file can force excessive memory consumption during file type detection on untrusted uploads, potentially degrading service performance or crashing applications in memory-constrained environments. This vulnerability affects applications that automatically scan user-uploaded files for security or validation purposes.
Technical details
This is a decompression bomb vulnerability (CWE-409) in the file-type library's ZIP format detection. The root cause is inconsistent size limits applied by the ZIP detection logic: stream-based detection enforces a 1 MiB inflation limit, but buffer/blob/file-based APIs use Number.MAX_SAFE_INTEGER instead, bypassing the intended protection. An attacker can craft a highly-compressed ZIP file (approximately 255 KB) containing an inflated [Content_Types].xml entry that expands to 256+ MB during detection with fileTypeFromBuffer(), fileTypeFromBlob(), or fileTypeFromFile(). No authentication or user interaction is required; the vulnerability is triggered automatically during type detection of untrusted uploads on network-reachable services. The fix is available in version 21.3.2 and later.
Affected products
- npm file-type >=20.0.0, <=21.3.1
Timeline
- 2026-03-13: disclosed
- 2026-03-13: patched: Patch released as version 21.3.2