CVE-2026-32630

{"id": "CVE-2026-32630", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32630", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-16T16:59:32.922021Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "sindresorhus", "product": "file-type", "versions": [{"status": "affected", "version": ">= 20.0.0, < 21.3.2"}]}]}], "published": "2026-03-16T14:19:40.593", "references": [{"url": "https://github.com/sindresorhus/file-type/commit/399b0f156063f5aeb1c124a7fd61028f3ea7c124", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/sindresorhus/file-type/security/advisories/GHSA-j47w-4g3g-c36v", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/sindresorhus/file-type/security/advisories/GHSA-j47w-4g3g-c36v", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-409"}]}], "descriptions": [{"lang": "en", "value": "file-type detects the file type of a file, stream, or data. From 20.0.0 to 21.3.1, a crafted ZIP file can trigger excessive memory growth during type detection in file-type when using fileTypeFromBuffer(), fileTypeFromBlob(), or fileTypeFromFile(). The ZIP inflate output limit is enforced for stream-based detection, but not for known-size inputs. As a result, a small compressed ZIP can cause file-type to inflate and process a much larger payload while probing ZIP-based formats such as OOXML. This vulnerability is fixed in 21.3.2."}, {"lang": "es", "value": "file-type detecta el tipo de archivo de un archivo, flujo o datos. Desde 20.0.0 hasta 21.3.1, un archivo ZIP manipulado puede provocar un crecimiento excesivo de la memoria durante la detecci\u00f3n de tipo en file-type al usar fileTypeFromBuffer(), fileTypeFromBlob() o fileTypeFromFile(). El l\u00edmite de salida de descompresi\u00f3n ZIP se aplica para la detecci\u00f3n basada en flujo, pero no para entradas de tama\u00f1o conocido. Como resultado, un ZIP comprimido peque\u00f1o puede hacer que file-type descomprima y procese una carga \u00fatil mucho mayor mientras sondea formatos basados en ZIP como OOXML. Esta vulnerabilidad est\u00e1 corregida en 21.3.2."}], "lastModified": "2026-06-17T10:36:07.973", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sindresorhus:file-type:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "D0F498D6-3940-4A11-8A75-5437FC77A0ED", "versionEndExcluding": "21.3.2", "versionStartIncluding": "20.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}