CVE-2026-106070

A flaw was found in the Node.js zlib.ZipFile API. After local and central ZIP header validation fails, reading zipEntry.modified (directly or while compacting) can leave a parsed local header cached without a content offset. A later content read may then return attacker-controlled bytes from the start of the archive instead of rejecting it, while CRC-32 verification can still pass because the attacker controls the central directory CRC. A Node.js-based scanner using ZipFile could therefore accept different content than another ZIP implementation extracts from the same archive. This API was introduced in the Node.js 26.x line.

This is a Low severity flaw. Red Hat rates it Low because impact is limited to integrity of ZipFile content reads (Integrity Low), exploitation requires a crafted mismatched ZIP and use of the experimental zlib.ZipFile API (high attack complexity), and the feature exists only in Node.js 26.x. Streams that do not ship Node.js 26 are not affected. Memory hardening does not prevent this validation logic error.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Avoid the experimental zlib.ZipFile API for security decisions on untrusted archives until Node.js is updated. Validate ZIP archives with a second, independent implementation before trusting extracted content. Do not treat CRC-32 alone as proof of entry integrity for adversarial inputs.