CVE-2026-32630: file-type ZIP decompression bomb DoS via [Content_Types].xml

CVE-2026-32630 · Severity: low · CVSS 3.1 · Published 2026-03-13

file-type is a popular Node.js library used to detect file types by analyzing file contents. A specially crafted ZIP file can force excessive memory consumption during file type detection on untrusted uploads, potentially degrading service performance or crashing applications in memory-constrained environments. This vulnerability affects applications that automatically scan user-uploaded files for security or validation purposes.

Technologies: file-type (npm). Vendors: npm.

Quick answers

Is CVE-2026-32630 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-32630 being exploited in the wild.
How severe is CVE-2026-32630?
Low severity, with a CVSS score of 3.1, published 13 March 2026.
Which products and versions are affected?
file-type (npm) >=20.0.0, <=21.3.1.
Is there a fix for CVE-2026-32630?
A patch was published on 2026-03-13: Patch released as version 21.3.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-32630 attacked?
It is attacked over the network.
Am I affected by CVE-2026-32630?
Check whether you run file-type (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a decompression bomb vulnerability (CWE-409) in the file-type library's ZIP format detection. The root cause is inconsistent size limits applied by the ZIP detection logic: stream-based detection enforces a 1 MiB inflation limit, but buffer/blob/file-based APIs use Number.MAX_SAFE_INTEGER instead, bypassing the intended protection. An attacker can craft a highly-compressed ZIP file (approximately 255 KB) containing an inflated [Content_Types].xml entry that expands to 256+ MB during detection with fileTypeFromBuffer(), fileTypeFromBlob(), or fileTypeFromFile(). No authentication or user interaction is required; the vulnerability is triggered automatically during type detection of untrusted uploads on network-reachable services. The fix is available in version 21.3.2 and later.

Affected products

  • npm file-type >=20.0.0, <=21.3.1

Identifiers

  • CVE-2026-32630
  • GHSA-j47w-4g3g-c36v

Timeline

  • 2026-03-13: disclosed
  • 2026-03-13: patched: Patch released as version 21.3.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.