Threats affecting pkg:npm/yauzl

CVE-2026-31988 is an off-by-one vulnerability in the yauzl Node.js library version 3.2.0, specifically in the NTFS extended timestamp extra field parser within the getLastModDate() function. The flaw allows a crafted zip file with a malformed NTFS extra field to cause a denial of service by triggering a process crash via an ERR_OUT_OF_RANGE exception. This occurs because the code reads beyond the buffer boundary due to incorrect loop boundary checks. The vulnerability affects any Node.js application that processes zip uploads and calls entry.getLastModDate() on parsed entries. No authentication or user interaction is required to exploit this remotely.