{"id":"CVE-2026-106070","title":"nodejs: Node.js: Security inspection bypass via crafted ZIP archive header mismatch (CVE-2026-106070)","summary":"A flaw was found in the Node.js zlib.ZipFile API. After local and central ZIP header validation fails, reading zipEntry.modified (directly or while compacting) can leave a parsed local header cached without a content offset. A later conten…","severity":"low","cvss":3.7,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","cvssSource":"vendor","cwe":["CWE-754","CWE-840"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","affected":["enterprise_linux 10","enterprise_linux 9"],"published":"2026-10-23","updated":"2026-10-26","sourceUpdated":"2026-10-26T11:05:36+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106070.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106070.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-106070"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2560020"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-106070"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106070"},{"url":"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases"}],"tags":["csaf","vex","red-hat","exploit-available","cve.org"],"epss":0.00347,"epssPercentile":0.28101,"exploits":{"github":1,"githubRepos":["https://github.com/CompleTetech-Security/node-cve-2026-106070-check"],"checkedAt":"2026-10-27T16:54:45.982Z"},"exploitAvailable":true,"ingestedAt":"2026-10-23T16:31:11.320Z","slug":"CVE-2026-106070","body":"## Overview\n\nA flaw was found in the Node.js zlib.ZipFile API. After local and central ZIP header validation fails, reading zipEntry.modified (directly or while compacting) can leave a parsed local header cached without a content offset. A later content read may then return attacker-controlled bytes from the start of the archive instead of rejecting it, while CRC-32 verification can still pass because the attacker controls the central directory CRC. A Node.js-based scanner using ZipFile could therefore accept different content than another ZIP implementation extracts from the same archive. This API was introduced in the Node.js 26.x line.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · updated 2026-10-26 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106070.json)\n\n**nodejs: Node.js: Security inspection bypass via crafted ZIP archive header mismatch** — rated Low by Red Hat. Released 2026-10-23, updated 2026-10-26.\n\nAffected:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 9\n\nNo fix planned:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 9\n\nNot affected:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat Hardened Images\n\n## Remediation\n\nFix deferred\n\nWorkarounds / mitigations:\n\n- Avoid the experimental zlib.ZipFile API for security decisions on untrusted archives until Node.js is updated.\nValidate ZIP archives with a second, independent implementation before trusting extracted content (CME-1310 File Upload Validation: https://cmetaxonomy.org/entries/CME-1310.html).\nDo not treat CRC-32 alone as proof of entry integrity for adversarial inputs.","depth":"twilight","depthScore":32,"depthScoreParts":{"impact":20.4,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":229082,"id":"CVE-2026-106070","ts":1792902179486,"field":"exploit_available","old":"false","new":"true"}]}