CVE-2026-31988: Yauzl Yauzl Contains An Off-by-one Error Vulnerability

MODERATE
Advisory Identifier: GHSA-gmq8-994r-jv83
Share
CVSS 5.3
CWE-193
Published
Advisory Summary

CVE-2026-31988 is a MODERATE (CVSS 5.3) yauzl contains an off-by-one error vulnerability (CWE-193: Off-by-one Error) affecting Yauzl libraries in the npm ecosystem. The issue involves yauzl contains an off-by-one error. Remediation is available by upgrading affected packages to version 3.2.1.

CVE-2026-31988 at a Glance

CVE Identifier CVE-2026-31988
GHSA Identifier GHSA-gmq8-994r-jv83
Severity MODERATE
CVSS v3.1 Base Score 5.3
CWE Classification CWE-193: Off-by-one Error
Affected Product Yauzl
Package Ecosystem npm
Published Date
Last Updated

Security Impact

CVSS: 5.3

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality None (C:N)
Integrity None (I:N)
Availability Low (A:L)

How to Fix CVE-2026-31988

To remediate this vulnerability, upgrade all affected Yauzl dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

yauzl fixed: 3.2.1 
npm install yauzl@3.2.1
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

npm ls yauzl

How to Check if You Are Affected

To determine whether your Node.js application is affected by CVE-2026-31988, inspect your project dependencies using npm:

npm ls yauzl

Analyze the terminal output to locate any version of Yauzl in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 3.2.1), your application is affected.

Note: The npm ls yauzl command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-193: Off-by-one Error, where a product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value. In Yauzl, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

yauzl (aka Yet Another Unzip Library) version 3.2.0 for Node.js contains an off-by-one error in the NTFS extended timestamp extra field parser within the getLastModDate() function. The while loop condition checks cursor < data.length + 4 instead of cursor + 4 <= data.length, allowing readUInt16LE() to read past the buffer boundary. A remote attacker can cause a denial of service (process crash via ERR_OUT_OF_RANGE exception) by sending a crafted zip file with a malformed NTFS extra field. This affects any Node.js application that processes zip file uploads and calls entry.getLastModDate() on parsed entries. Fixed in version 3.2.1.

CVE-2026-31988 Affected Yauzl Versions

1 component(s)
Fixed Versions:
3.2.1
Product / Package Ecosystem Affected Versions Fixed Version
yauzl
npm/yauzl
npm
≥ 3.2.0
< 3.2.1
All 1 versions
3.2.0
3.2.1

References

NVD — CVE-2026-31988 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-31988
Security Fix Commit FIX COMMIT
https://github.com/thejoshwolfe/yauzl/commit/c4695215b05c6adffda613b9051a2a85429b33fe
Yauzl Source Repository REPOSITORY
https://github.com/thejoshwolfe/yauzl
Yauzl Security Information SECURITY
https://www.codeant.ai/security-research/yauzl-denial-of-service-zip-file-crash
www.npmjs.com/package/yauzl WEB
https://www.npmjs.com/package/yauzl
www.vulncheck.com/advisories/yauzl-de... WEB
https://www.vulncheck.com/advisories/yauzl-denial-of-service-via-off-by-one-error-in-ntfs-timestamp-parser

Frequently Asked Questions

What is CVE-2026-31988?
CVE-2026-31988 is a security vulnerability in Yauzl involving yauzl contains an off-by-one error under CWE-193: Off-by-one Error.
Which Yauzl versions are affected?
Affected versions include releases prior to 3.2.1 across affected packages: yauzl.
What version fixes CVE-2026-31988?
Upgrading to 3.2.1 (or the latest patched release for your respective branch) resolves the vulnerability.
Is yauzl affected?
Yes, yauzl is affected in releases prior to 3.2.1. Upgrade your dependency to 3.2.1 or later.
What is the CVSS score of CVE-2026-31988?
CVE-2026-31988 has a CVSS v3.1 base score of 5.3 (MODERATE) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.
What CWE is associated with CVE-2026-31988?
CVE-2026-31988 is classified under CWE-193: Off-by-one Error (A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.).
How can I check npm dependencies for CVE-2026-31988?
Run the dependency tree command: 'npm ls yauzl'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-gmq8-994r-jv83",
  "modified" : "2026-03-16T12:35:31Z",
  "published" : "2026-03-12T00:31:17Z",
  "aliases" : [ "CVE-2026-31988" ],
  "summary" : "yauzl contains an off-by-one error",
  "details" : "yauzl (aka Yet Another Unzip Library) version 3.2.0 for Node.js contains an off-by-one error in the NTFS extended timestamp extra field parser within the getLastModDate() function. The while loop condition checks cursor < data.length + 4 instead of cursor + 4 <= data.length, allowing readUInt16LE() to read past the buffer boundary. A remote attacker can cause a denial of service (process crash via ERR_OUT_OF_RANGE exception) by sending a crafted zip file with a malformed NTFS extra field. This affects any Node.js application that processes zip file uploads and calls entry.getLastModDate() on parsed entries. Fixed in version 3.2.1.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
  }, {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "yauzl"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "3.2.0"
      }, {
        "fixed" : "3.2.1"
      } ]
    } ],
    "versions" : [ "3.2.0" ]
  } ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-31988"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/thejoshwolfe/yauzl/commit/c4695215b05c6adffda613b9051a2a85429b33fe"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/thejoshwolfe/yauzl"
  }, {
    "type" : "WEB",
    "url" : "https://www.codeant.ai/security-research/yauzl-denial-of-service-zip-file-crash"
  }, {
    "type" : "WEB",
    "url" : "https://www.npmjs.com/package/yauzl"
  }, {
    "type" : "WEB",
    "url" : "https://www.vulncheck.com/advisories/yauzl-denial-of-service-via-off-by-one-error-in-ntfs-timestamp-parser"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-193" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-03-13T18:58:11Z",
    "nvd_published_at" : "2026-03-11T23:16:00Z"
  }
}