CVE-2026-106070: CWE-840 Business Logic Errors in nodejs node

CVE-2026-106070 describes a business logic error (CWE-840) in Node.js version 26.x within the zlib.ZipFile API. When reading the modified property of a zip entry whose local header does not match the central directory, the validation error is caught but the local header is cached without a content offset. Subsequent reads return attacker-controlled bytes from the start of the file instead of rejecting the archive. The CRC-32 check passes because the attacker controls the central directory CRC, enabling a Node.js-based scanner to approve content differing from what other ZIP tools extract.

The vulnerability allows an attacker to craft ZIP archives that cause Node.js applications using zlib.ZipFile to return manipulated content without detection, potentially leading to incorrect processing or validation of ZIP entries. However, the CVSS score is low (3.7) and the impact is limited to integrity issues without confidentiality or availability impact. There are no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should be cautious when processing ZIP archives with Node.js 26.x and consider additional validation or using alternative ZIP processing tools.