nodejs: Node.js: Security inspection bypass via crafted ZIP archive header mismatch (CVE-2026-106070)

Overview

A flaw was found in the Node.js zlib.ZipFile API. After local and central ZIP header validation fails, reading zipEntry.modified (directly or while compacting) can leave a parsed local header cached without a content offset. A later content read may then return attacker-controlled bytes from the start of the archive instead of rejecting it, while CRC-32 verification can still pass because the attacker controls the central directory CRC. A Node.js-based scanner using ZipFile could therefore accept different content than another ZIP implementation extracts from the same archive. This API was introduced in the Node.js 26.x line.

Vendor advisories

• Red Hat VEX · Low · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · updated 2026-10-26 · vex

nodejs: Node.js: Security inspection bypass via crafted ZIP archive header mismatch — rated Low by Red Hat. Released 2026-10-23, updated 2026-10-26.

Affected:

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9

No fix planned:

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9

Not affected:

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 9
• Red Hat Hardened Images

Remediation

Fix deferred

Workarounds / mitigations:

• Avoid the experimental zlib.ZipFile API for security decisions on untrusted archives until Node.js is updated. Validate ZIP archives with a second, independent implementation before trusting extracted content (CME-1310 File Upload Validation: https://cmetaxonomy.org/entries/CME-1310.html). Do not treat CRC-32 alone as proof of entry integrity for adversarial inputs.