Moderate severityNVD Advisory· Published Mar 13, 2026· Updated Mar 16, 2026
file-type affected by ZIP Decompression Bomb DoS via [Content_Types].xml entry
CVE-2026-32630
Description
file-type detects the file type of a file, stream, or data. From 20.0.0 to 21.3.1, a crafted ZIP file can trigger excessive memory growth during type detection in file-type when using fileTypeFromBuffer(), fileTypeFromBlob(), or fileTypeFromFile(). The ZIP inflate output limit is enforced for stream-based detection, but not for known-size inputs. As a result, a small compressed ZIP can cause file-type to inflate and process a much larger payload while probing ZIP-based formats such as OOXML. This vulnerability is fixed in 21.3.2.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
file-typenpm | >= 20.0.0, < 21.3.2 | 21.3.2 |
Affected products
3- osv-coords2 versions
< 3.2.0-r2+ 1 more
- (no CPE)range: < 3.2.0-r2
- (no CPE)range: >= 20.0.0, < 21.3.2
- sindresorhus/file-typev5Range: >= 20.0.0, < 21.3.2
Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-j47w-4g3g-c36vghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-32630ghsaADVISORY
- github.com/sindresorhus/file-type/commit/399b0f156063f5aeb1c124a7fd61028f3ea7c124ghsax_refsource_MISCWEB
- github.com/sindresorhus/file-type/commit/a155cd71323279de173c54e8c530d300d3854fddghsaWEB
- github.com/sindresorhus/file-type/releases/tag/v21.3.2ghsaWEB
- github.com/sindresorhus/file-type/security/advisories/GHSA-j47w-4g3g-c36vghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.