{"id":"EUVD-2026-10894","enisaUuid":"407ccc35-9aa3-3d9c-a962-1ddcb97bfa2f","description":"file-type detects the file type of a file, stream, or data. Prior to 21.3.1, a denial of service vulnerability exists in the ASF (WMV/WMA) file type detection parser. When parsing a crafted input where an ASF sub-header has a size field of zero, the parser enters an infinite loop. The payload value becomes negative (-24), causing tokenizer.ignore(payload) to move the read position backwards, so the same sub-header is read repeatedly forever. Any application that uses file-type to detect the type of untrusted/attacker-controlled input is affected. An attacker can stall the Node.js event loop with a 55-byte payload. Fixed in version 21.3.1.","datePublished":"Mar 10, 2026, 9:01:55 PM","dateUpdated":"Mar 11, 2026, 4:00:14 PM","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","references":"https://github.com/sindresorhus/file-type/security/advisories/GHSA-5v7r-6r5c-r473\nhttps://github.com/sindresorhus/file-type/commit/319abf871b50ba2fa221b4a7050059f1ae096f4f\n","aliases":"CVE-2026-31808\nGHSA-5v7r-6r5c-r473\n","assigner":"GitHub_M","epss":0.37,"enisaIdProduct":[{"id":"9bf6d239-ca7c-3f7b-8cda-11a4637f288f","product":{"name":"file-type","vendor":{"name":"sindresorhus"}},"product_version":"13.0.0, \u003c 21.3.1"}],"enisaIdVendor":[{"id":"01be1476-ad24-35ea-8470-b2f2ffb0b473","vendor":{"name":"sindresorhus"}}],"enisaIdVulnerability":[{"id":"088c88d5-9366-3a20-9506-561e12b3ba5f","vulnerability":{"id":"GHSA-5v7r-6r5c-r473","description":"file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-header","datePublished":"Mar 10, 2026, 11:57:09 PM","dateUpdated":"Mar 10, 2026, 11:57:09 PM","baseScore":0.0,"references":"https://github.com/sindresorhus/file-type/security/advisories/GHSA-5v7r-6r5c-r473\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31808\nhttps://github.com/sindresorhus/file-type/commit/319abf871b50ba2fa221b4a7050059f1ae096f4f\nhttps://github.com/sindresorhus/file-type\n","enisa_id":"EUVD-2026-10894\n","aliases":"GHSA-5v7r-6r5c-r473\nCVE-2026-31808\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:58:58 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"c91fffbd-1721-3dd8-8ffe-510fd4349cfe","vulnerability":{"id":"CVE-2026-31808","description":"file-type detects the file type of a file, stream, or data. Prior to 21.3.1, a denial of service vulnerability exists in the ASF (WMV/WMA) file type detection parser. When parsing a crafted input where an ASF sub-header has a size field of zero, the parser enters an infinite loop. The payload value becomes negative (-24), causing tokenizer.ignore(payload) to move the read position backwards, so the same sub-header is read repeatedly forever. Any application that uses file-type to detect the type of untrusted/attacker-controlled input is affected. An attacker can stall the Node.js event loop with a 55-byte payload. Fixed in version 21.3.1.","datePublished":"Mar 10, 2026, 9:01:55 PM","dateUpdated":"Mar 11, 2026, 4:00:14 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","references":"https://github.com/sindresorhus/file-type/security/advisories/GHSA-5v7r-6r5c-r473\nhttps://github.com/sindresorhus/file-type/commit/319abf871b50ba2fa221b4a7050059f1ae096f4f\n","enisa_id":"EUVD-2026-10894\n","assigner":"GitHub_M","epss":0.37,"dataProcessed":"Nov 7, 2026, 7:21:34 AM","vulnerabilityProduct":[{"id":"8e7cb01d-f123-3d57-b093-b25c784263b5","product":{"name":"file-type","vendor":{"name":"sindresorhus"}},"product_version":"13.0.0, \u003c 21.3.1"}],"vulnerabilityVendor":[{"id":"6caac759-fc2e-3bbe-af2e-b455a01b2779","vendor":{"name":"sindresorhus"}}]}}],"enisaIdAdvisory":[{"id":"f75b2015-d2c9-343a-9ca2-3f3f2f707daa","advisory":{"id":"WID-SEC-W-2026-3046","description":"IBM Concert: Mehrere Schwachstellen","summary":"Ein Angreifer kann mehrere Schwachstellen in IBM Concert ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen, um einen SQL-Injection Angriff durchzuführen und um Sicherheitsvorkehrungen zu umgehen.","datePublished":"Aug 26, 2026, 10:00:00 PM","dateUpdated":"Aug 30, 2026, 10:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-3046.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2026-3046\n","aliases":"CVE-2019-19921\nCVE-2021-23337\nCVE-2024-3651\nCVE-2024-39338\nCVE-2024-45590\nCVE-2025-13465\nCVE-2025-15284\nCVE-2025-15599\nCVE-2025-22874\nCVE-2025-47273\nCVE-2025-47907\nCVE-2025-52881\nCVE-2025-53643\nCVE-2025-55184\nCVE-2025-58056\nCVE-2025-58188\nCVE-2025-58189\nCVE-2025-61723\nCVE-2025-61730\nCVE-2025-64649\nCVE-2025-64756\nCVE-2025-67221\nCVE-2025-68121\nCVE-2025-68146\nCVE-2026-0540\nCVE-2026-2327\nCVE-2026-23490\nCVE-2026-23897\nCVE-2026-2391\nCVE-2026-23949\nCVE-2026-24486\nCVE-2026-25528\nCVE-2026-25547\nCVE-2026-25639\nCVE-2026-25990\nCVE-2026-26007\nCVE-2026-26019\nCVE-2026-26996\nCVE-2026-27142\nCVE-2026-27212\nCVE-2026-27699\nCVE-2026-27903\nCVE-2026-27904\nCVE-2026-28684\nCVE-2026-29063\nCVE-2026-29181\nCVE-2026-2950\nCVE-2026-31808\nCVE-2026-31900\nCVE-2026-32274\nCVE-2026-32288\nCVE-2026-32597\nCVE-2026-32630\nCVE-2026-32887\nCVE-2026-32952\nCVE-2026-33186\nCVE-2026-33532\nCVE-2026-33750\nCVE-2026-33814\nCVE-2026-33816\nCVE-2026-33916\nCVE-2026-34043\nCVE-2026-34073\nCVE-2026-34077\nCVE-2026-3520\nCVE-2026-35469\nCVE-2026-35515\nCVE-2026-3627\nCVE-2026-39823\nCVE-2026-39825\nCVE-2026-39826\nCVE-2026-39892\nCVE-2026-39984\nCVE-2026-40175\nCVE-2026-40179\nCVE-2026-40181\nCVE-2026-40190\nCVE-2026-40347\nCVE-2026-41066\nCVE-2026-41182\nCVE-2026-41238\nCVE-2026-41239\nCVE-2026-41240\nCVE-2026-41305\nCVE-2026-41324\nCVE-2026-41425\nCVE-2026-41481\nCVE-2026-41488\nCVE-2026-41602\nCVE-2026-41636\nCVE-2026-42151\nCVE-2026-42154\nCVE-2026-42198\nCVE-2026-42211\nCVE-2026-42338\nCVE-2026-42342\nCVE-2026-42561\nCVE-2026-42577\nCVE-2026-43870\nCVE-2026-44405\nCVE-2026-44431\nCVE-2026-44432\nCVE-2026-44486\nCVE-2026-44487\nCVE-2026-44488\nCVE-2026-44492\nCVE-2026-44494\nCVE-2026-44496\nCVE-2026-44728\nCVE-2026-4539\nCVE-2026-45409\nCVE-2026-45736\nCVE-2026-46625\nCVE-2026-4800\nCVE-2026-4923\nCVE-2026-4926\nCVE-2026-7246\nCVE-2026-8723\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"76a90dbd-da59-3443-a232-e3bd24181126","product":{"name":"Concert","vendor":{"name":"IBM"}}},{"id":"cc1d243a-3c05-3835-99df-7ead0933e4bb","product":{"name":"3.0.0","vendor":{"name":"ECOVACS"}}}]}}]}