CVE-2026-31988

yauzl (aka Yet Another Unzip Library) version 3.2.0 for Node.js contains an off-by-one error in the NTFS extended timestamp extra field parser within the getLastModDate() function. The while loop condition checks cursor < data.length + 4 instead of cursor + 4 <= data.length, allowing readUInt16LE() to read past the buffer boundary. A remote attacker can cause a denial of service (process crash via ERR_OUT_OF_RANGE exception) by sending a crafted zip file with a malformed NTFS extra field. This affects any Node.js application that processes zip file uploads and calls entry.getLastModDate() on parsed entries. Fixed in version 3.2.1.

• CWE-193

• https://github.com/thejoshwolfe/yauzl/commit/c4695215b05c6adffda613b9051a2a85429b33fe
• https://www.codeant.ai/security-research/yauzl-denial-of-service-zip-file-crash
• https://www.npmjs.com/package/yauzl
• https://www.vulncheck.com/advisories/yauzl-denial-of-service-via-off-by-one-error-in-ntfs-timestamp-parser
• https://www.codeant.ai/security-research/yauzl-denial-of-service-zip-file-crash

Published

Mar 11, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-31982An Open Redirect vulnerability was discovered in the SAML Si…7.1
• CVE-2026-31983A Missing Authentication vulnerability was discovered in the…6.9
• CVE-2026-31984A denial-of-service vulnerability caused by unbounded resour…8.7
• CVE-2026-31985When the upstream Guardian or CMC was configured in the Remo…8.3
• CVE-2026-31986Use of Hard-coded Cryptographic Key vulnerability in Apache …9.1
• CVE-2026-31987JWT Tokens used by tasks were exposed in logs. This could al…7.5
• CVE-2026-31989OpenClaw versions prior to 2026.3.1 contain a server-side re…6.3
• CVE-2026-3199A vulnerability in the task management component of Sonatype…9.4
• CVE-2026-31990OpenClaw versions prior to 2026.3.2 contain a vulnerability …7.1
• CVE-2026-31991OpenClaw versions prior to 2026.2.26 contain an authorizatio…4.6
• CVE-2026-31992OpenClaw versions prior to 2026.2.23 contain an allowlist by…8.8
• CVE-2026-31993OpenClaw versions prior to 2026.2.22 contain an allowlist pa…6.4