CVE-2026-32630: 
JavaScript vulnerability analysis and mitigation

CVE-2026-32630 is a ZIP decompression bomb (data amplification) vulnerability in the file-type npm package that allows unauthenticated remote attackers to cause excessive memory consumption during file type detection. It affects versions 20.0.0 through 21.3.1 of sindresorhus/file-type for Node.js. The vulnerability was published on March 13, 2026, and patched the same day in version 21.3.2. It carries a CVSS v3.1 base score of 5.3 (Medium) (Github Advisory, Security Advisory). Downstream products including IBM DevOps Solution Workbench and IBM API Connect are also affected (IBM Advisory).

The root cause is classified as CWE-409 (Improper Handling of Highly Compressed Data / Data Amplification) and CWE-400 (Uncontrolled Resource Consumption). The vulnerability was introduced in commit 399b0f1, which added ZIP decompression support via @tokenizer/inflate. The ZIP detection logic applied different inflate output limits depending on whether the tokenizer had a known file size: stream-based inputs were bounded by maximumZipEntrySizeInBytes (1 MiB), but buffer, blob, and file inputs used Number.MAX_SAFE_INTEGER as the limit — effectively no limit. This allowed a crafted ZIP containing a highly compressed [Content_Types].xml entry to force the library to inflate and process a payload orders of magnitude larger than the compressed input during OOXML format probing. In testing, a ~255 KB ZIP caused ~257 MB of RSS memory growth during a single fileTypeFromBuffer() call (Security Advisory, Fix Commit).

The sole impact is availability: an unauthenticated attacker can submit a crafted ZIP file to any application that passes untrusted uploads to fileTypeFromBuffer(), fileTypeFromBlob(), or fileTypeFromFile(), causing the Node.js process to consume hundreds of megabytes of memory per request. In memory-constrained environments this can lead to process termination or service crash. There is no confidentiality or integrity impact, and the vulnerability does not enable lateral movement or data exfiltration (Security Advisory).

A complete, self-contained JavaScript proof-of-concept is publicly available in the GitHub Security Advisory, demonstrating the decompression bomb effect without requiring network interaction or authentication (Security Advisory). No weaponized exploit kits or in-the-wild exploitation have been observed as of the time of disclosure. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.039–0.079%, placing it in the lower percentiles for near-term exploitation likelihood (Github Advisory).

1. Identify target: Locate a web application or service that accepts file uploads and uses the file-type npm package (versions 20.0.0–21.3.1) with fileTypeFromBuffer(), fileTypeFromBlob(), or fileTypeFromFile() to inspect uploaded content.
2. Craft the ZIP bomb: Using Node.js and the archiver library, create a ZIP archive containing a single entry named [Content_Types].xml with highly compressed content (e.g., 256 MB of whitespace compressed to ~255 KB using zlib level 9).
3. Upload the crafted file: Submit the malicious ZIP (~255 KB) to the target application's file upload endpoint, triggering the vulnerable file type detection code path.
4. Trigger memory exhaustion: When the application calls fileTypeFromBuffer() (or equivalent) on the uploaded data, the library inflates the [Content_Types].xml entry without enforcing the 1 MiB limit, consuming ~257 MB of RSS memory per request.
5. Achieve denial of service: Repeat submissions (or a single submission in a memory-constrained environment) exhaust available memory, causing the Node.js process to slow significantly or crash, denying service to legitimate users (Security Advisory).

• Network: Repeated upload requests containing small ZIP files (~200–300 KB) to file-handling endpoints, particularly from a single source IP or in rapid succession.
• Process: Node.js process RSS memory spiking by hundreds of megabytes during file type detection operations; process restarts or OOM-killer events in application logs.
• Logs: Application logs showing fileTypeFromBuffer(), fileTypeFromBlob(), or fileTypeFromFile() calls followed by memory allocation errors or process crashes; uploaded files with a [Content_Types].xml entry that has an anomalously high compression ratio.
• File System: Uploaded ZIP files on disk that are small in size (hundreds of KB) but contain entries with declared uncompressed sizes in the hundreds of MB range.

The fix is available in file-type version 21.3.2, released March 13, 2026. The patch (commit a155cd7) removes the conditional logic and enforces maximumZipEntrySizeInBytes (1 MiB) as the inflate limit for all input types, not just streams (Fix Commit, Release Notes). If immediate patching is not possible, mitigations include: validating and rejecting ZIP files before passing them to file-type; enforcing process-level memory limits (e.g., Node.js --max-old-space-size); or switching to fileTypeFromStream(), which was not affected. IBM has released patches for IBM DevOps Solution Workbench and IBM API Connect (IBM Advisory).

The vulnerability was reported by security researcher ByamB4 and disclosed responsibly through GitHub's security advisory process. The maintainer (sindresorhus) published the fix and advisory simultaneously on March 13, 2026. No significant broader media coverage or notable community controversy has been identified beyond standard vulnerability tracking and aggregation sites.