file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-header

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-31808 · CVE overview and exploitation status

EUVD-2026-10894

GHSA-5v7r-6r5c-r473

cve-program · CVE-2026-31808

• https://github.com/sindresorhus/file-type/security/advisories/GHSA-5v7r-6r5c-r473
• https://github.com/sindresorhus/file-type/commit/319abf871b50ba2fa221b4a7050059f1ae096f4f

euvd · EUVD-2026-10894

• https://github.com/sindresorhus/file-type/security/advisories/GHSA-5v7r-6r5c-r473
• https://github.com/sindresorhus/file-type/commit/319abf871b50ba2fa221b4a7050059f1ae096f4f

nvd · CVE-2026-31808

• https://github.com/sindresorhus/file-type/commit/319abf871b50ba2fa221b4a7050059f1ae096f4f
• https://github.com/sindresorhus/file-type/security/advisories/GHSA-5v7r-6r5c-r473

osv · GHSA-5v7r-6r5c-r473

• https://github.com/sindresorhus/file-type/security/advisories/GHSA-5v7r-6r5c-r473
• https://nvd.nist.gov/vuln/detail/CVE-2026-31808
• https://github.com/sindresorhus/file-type/commit/319abf871b50ba2fa221b4a7050059f1ae096f4f
• https://github.com/sindresorhus/file-type

• file-type detects the file type of a file, stream, or data. Prior to 21.3.1, a denial of service vulnerability exists in the ASF (WMV/WMA) file type detection parser. When parsing a crafted input where an ASF sub-header has a size field of … · Advisory content revised · 15 Nov 2026