CVE-2026-106070Published

A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails.

Exact source revision recorded 23 Oct 2026 17:48:20 UTC. It does not establish the source's current position. Latest evidence.

Recorded JSON

cve-program · CVE-2026-106070

Published

node

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "defaultStatus": "unaffected",
                    "vendor": "nodejs",
                    "product": "node",
                    "versions": [
                        {
                            "version": "26.12.0",
                            "status": "affected",
                            "lessThanOrEqual": "26.12.0",
                            "versionType": "semver"
                        }
                    ]
                }