Threats tagged 'bit-node-2026-106070'

A vulnerability in the Node.js zlib.ZipFile API allows it to return bytes not belonging to the requested ZIP entry when local and central header validation fails. This occurs because the parsed local header is cached without a content offset, causing subsequent reads to return attacker-controlled bytes from the start of the file. The CRC-32 check still passes due to attacker control of the central directory CRC. This can cause Node.js-based ZIP scanners to approve different content than other ZIP implementations extract. The flaw affects Node.js versions 25.0.0 up to but not including 26.12.1 and is fixed in 26.12.1.