Flaw in Node.js zlib.ZipFile API Allows Unauthorized Byte Retrieval

CVE-2026-106070

What is CVE-2026-106070?

A flaw in the Node.js zlib.ZipFile API can lead to unauthorized byte retrieval when local and central header validations fail during archival processing. Specifically, if the zipEntry.modified attribute is accessed on an archive where the local header does not align with the central directory, an attacker may exploit this oversight. The validation error is detected, but the local header retains a cached state without a valid content offset, allowing future reads to inadvertently return attacker-controlled bytes. This occurs without triggering an error, as CRC-32 verification may still appear valid due to the attacker’s control over the central directory CRC. This discrepancy presents significant security risks, enabling possible data leakage and exploitation across different implementations of ZIP archives.

References