CVE-2026-32630

Katalog CVE

CVSS 5.3 · Medium EPSS 0,45%

Kerentanan Improper Handling of Highly Compressed Data (Data Amplification) pada sindresorhus file-type. Skor CVSS 3.1 5.3 (Medium) menurut github.com.

Deskripsi (NVD)

file-type detects the file type of a file, stream, or data. From 20.0.0 to 21.3.1, a crafted ZIP file can trigger excessive memory growth during type detection in file-type when using fileTypeFromBuffer(), fileTypeFromBlob(), or fileTypeFromFile(). The ZIP inflate output limit is enforced for stream-based detection, but not for known-size inputs. As a result, a small compressed ZIP can cause file-type to inflate and process a much larger payload while probing ZIP-based formats such as OOXML. This vulnerability is fixed in 21.3.2.

Rincian

Terbit di NVD

16 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)

EPSS (30 hari)

0,45% peluang dieksploitasi; lebih tinggi dari 37,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/sindresorhus/file-type/security/advisories/GHSA-j47w-4g3g-c36v exploit · advisory vendor
• https://github.com/sindresorhus/file-type/commit/399b0f156063f5aeb1c124a7fd61028f3ea7c124 patch