CVE-2026-31988

A flaw was found in yauzl (Yet Another Unzip Library), a component used in Node.js applications for handling zip files. A remote attacker can exploit an error in how the library processes specific timestamp information within a crafted zip file. This can lead to a denial of service (DoS), causing affected applications to crash and become unavailable.

Moderate: This flaw in yauzl can lead to a denial of service in Node.js applications that process zip file uploads and specifically call entry.getLastModDate() on parsed entries. Red Hat products that utilize the affected yauzl library in this manner are susceptible to a process crash when handling a specially crafted zip file containing a malformed NTFS extra field.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.