# CVE-2026-32630: file-type ZIP decompression bomb DoS via [Content_Types].xml

Source: https://junglewise.ai/threats/cve-2026-32630-file-type-zip-decompression-bomb-dos-via-content-types-xml  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-13. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-32630 · Severity: low · CVSS 3.1 · Published 2026-03-13

file-type is a popular Node.js library used to detect file types by analyzing file contents. A specially crafted ZIP file can force excessive memory consumption during file type detection on untrusted uploads, potentially degrading service performance or crashing applications in memory-constrained environments. This vulnerability affects applications that automatically scan user-uploaded files for security or validation purposes.

Technologies: [file-type (npm)](https://junglewise.ai/threats/technologies/file-type). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-32630 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-32630 being exploited in the wild.

**How severe is CVE-2026-32630?** Low severity, with a CVSS score of 3.1, published 13 March 2026.

**Which products and versions are affected?** file-type (npm) >=20.0.0, <=21.3.1.

**Is there a fix for CVE-2026-32630?** A patch was published on 2026-03-13: Patch released as version 21.3.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-32630 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-32630?** Check whether you run file-type (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a decompression bomb vulnerability (CWE-409) in the file-type library's ZIP format detection. The root cause is inconsistent size limits applied by the ZIP detection logic: stream-based detection enforces a 1 MiB inflation limit, but buffer/blob/file-based APIs use Number.MAX_SAFE_INTEGER instead, bypassing the intended protection. An attacker can craft a highly-compressed ZIP file (approximately 255 KB) containing an inflated [Content_Types].xml entry that expands to 256+ MB during detection with fileTypeFromBuffer(), fileTypeFromBlob(), or fileTypeFromFile(). No authentication or user interaction is required; the vulnerability is triggered automatically during type detection of untrusted uploads on network-reachable services. The fix is available in version 21.3.2 and later.

## Affected products

- npm file-type >=20.0.0, <=21.3.1

## Identifiers

- CVE-2026-32630
- GHSA-j47w-4g3g-c36v

## Timeline

- 2026-03-13: disclosed
- 2026-03-13: patched: Patch released as version 21.3.2

## References

- [https://github.com/sindresorhus/file-type/security/advisories/GHSA-j47w-4g3g-c36v](https://github.com/sindresorhus/file-type/security/advisories/GHSA-j47w-4g3g-c36v)

## Related threats

- [Sindresorhus file-type infinite loop in ASF parser](https://junglewise.ai/threats/cve-2026-31808-sindresorhus-file-type-infinite-loop-in-asf-parser)
- [file-type infinite loop via malformed MKV file](https://junglewise.ai/threats/cve-2022-36313-file-type-infinite-loop-via-malformed-mkv-file)