CVE-2026-31988: 
JavaScript vulnerability analysis and mitigation

CVE-2026-31988 is a denial-of-service vulnerability in yauzl (Yet Another Unzip Library) version 3.2.0 for Node.js, caused by an off-by-one error in the NTFS extended timestamp extra field parser. The flaw exists within the getLastModDate() function, where an incorrect while loop boundary condition allows a buffer overread. It was published on March 11, 2026, and affects yauzl 3.2.0, with a fix released in version 3.2.1. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (Feedly, VulnCheck).

The root cause is an off-by-one error (CWE-193) in the NTFS extra field parser within yauzl's getLastModDate() function. The while loop condition incorrectly checks cursor < data.length + 4 instead of the safe cursor + 4 <= data.length, allowing readUInt16LE() to read past the end of the allocated buffer. When a crafted zip file containing a malformed NTFS extra field is processed, this out-of-bounds read triggers an ERR_OUT_OF_RANGE exception, crashing the Node.js process. The bug was discovered by CodeAnt AI Code Reviewer and fixed in commit c4695215b05c6adffda613b9051a2a85429b33fe (GitHub Commit, CodeAnt Research).

Successful exploitation results in a denial of service — specifically, a process crash via an unhandled ERR_OUT_OF_RANGE exception in the Node.js runtime. Any application that accepts zip file uploads and calls entry.getLastModDate() on parsed entries is vulnerable, potentially making services unavailable to legitimate users. There is no impact on confidentiality or integrity; the vulnerability is limited to availability (Feedly, VulnCheck).

No public exploit code or in-the-wild exploitation has been reported for CVE-2026-31988. The EPSS score is approximately 0.001 (0.1%), indicating a very low probability of exploitation in the near term. The vulnerability requires no authentication and no user interaction, as an attacker only needs to submit a crafted zip file to a vulnerable endpoint. It is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly).

1. Reconnaissance: Identify Node.js web applications that accept zip file uploads and use the yauzl library version 3.2.0 for parsing (e.g., via npm package inspection or application fingerprinting).
2. Craft malicious zip file: Create a zip file with a malformed NTFS extra field in a local file header or central directory entry, specifically crafting the NTFS extra field data length to be just short of the 4-byte boundary required by readUInt16LE(), triggering the off-by-one condition.
3. Submit the file: Upload the crafted zip file to the target application's file upload endpoint via HTTP POST or any other supported upload mechanism.
4. Trigger the crash: The application processes the zip file and calls entry.getLastModDate() on the parsed entry; the malformed NTFS extra field causes readUInt16LE() to read past the buffer boundary, throwing an ERR_OUT_OF_RANGE exception and crashing the Node.js process (CodeAnt Research, VulnCheck).

• Logs: Node.js application logs showing unhandled ERR_OUT_OF_RANGE exceptions originating from the yauzl getLastModDate() function or NTFS extra field parsing code; repeated process crashes or restarts in application/process manager logs (e.g., PM2, systemd).
• Network: Repeated HTTP POST requests to file upload endpoints with zip files of unusual or minimal size; multiple requests from the same source IP triggering application crashes.
• Process: Unexpected Node.js process terminations or restarts correlated with zip file upload activity; crash dump files generated by the Node.js runtime.

The primary remediation is to upgrade yauzl to version 3.2.1, which corrects the off-by-one error in the NTFS timestamp parser (GitHub Commit). IBM has released patches for affected products including IBM API Connect, IBM App Connect Enterprise Certified Container, IBM Cloud Pak for AIOps, and IBM QRadar Suite Software (IBM Advisory, IBM CloudPak Advisory). As a temporary workaround where upgrading is not immediately possible, applications can validate zip file structure and reject malformed entries before calling entry.getLastModDate(), or avoid calling that function on untrusted input.

The vulnerability was discovered by CodeAnt AI Code Reviewer, which published a dedicated security research post detailing the bug (CodeAnt Research). VulnCheck assigned the CVE and published an advisory. IBM issued multiple security bulletins for its enterprise products that bundle yauzl as a dependency, reflecting the library's broad use in enterprise Node.js ecosystems (IBM Advisory). Community reaction has been limited given the moderate severity and narrow impact scope.