What is the CVSS score of CVE-2022-36313?

CVE-2022-36313 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Node.js are affected by CVE-2022-36313?

Organizations using the file-type package should be aware of moderate risk from CVE-2022-36313 rated CVSS 5.5. Exploitation could compromise the security of affected deployments.. A patch is available.

Is there a public PoC exploit available for CVE-2022-36313?

Yes, a public proof-of-concept exploit is available for CVE-2022-36313. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2022-36313?

Within 30 days: Identify affected systems running the file-type package and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Node.js CVE-2022-36313

MEDIUM

Loop with Unreachable Exit Condition (Infinite Loop) (CWE-835)

2022-07-21 cve@mitre.org

GHSA-mhxj-85r3-2x55

Denial Of Service Node.js File Type

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 17, 2026 - 20:45 vuln.today

PoC Detected

Mar 17, 2026 - 19:18 vuln.today

Public exploit code

CVE Published

Jul 21, 2022 - 16:15 nvd

MEDIUM 5.5

DescriptionCVE.org

An issue was discovered in the file-type package before 16.5.4 and 17.x before 17.1.3 for Node.js. A malformed MKV file could cause the file type detector to get caught in an infinite loop. This would make the application become unresponsive and could be used to cause a DoS attack.

AnalysisAI

A malformed MKV file can trigger an infinite loop in the file-type Node.js package (versions before 16.5.4 and 17.x before 17.1.3), causing application unresponsiveness and enabling denial-of-service attacks. The vulnerability affects the Sindresorhus file-type library, a widely-used dependency for file type detection, and requires only local access and user interaction to trigger (CVSS 5.5). With an EPSS score of 0.17% (38th percentile), actual exploitation probability remains relatively low despite the moderate severity rating.

Technical ContextAI

The file-type package is a popular Node.js library maintained by Sindresorhus used for detecting file types by examining magic bytes and file signatures. The vulnerability resides in the MKV (Matroska Video) file format parsing logic, where improper loop termination conditions allow a specially-crafted MKV header structure to cause infinite iteration. The root cause is classified under CWE-835 (Infinite Loop), indicating the parser fails to implement proper bounds checking or exit conditions when processing malformed MKV container structures. The affected CPE entries (cpe:2.3:a:sindresorhus:file-type:*:*:*:*:*:node.js:*:*) indicate the vulnerability exists across all versions prior to the patched releases in both the 16.x and 17.x release branches.

RemediationAI

Upgrade the file-type package to version 16.5.4 or later for the 16.x branch, or to version 17.1.3 or later for the 17.x branch. Users should update their package.json dependencies and run npm update or yarn upgrade to pull the patched versions from the npm registry (https://www.npmjs.com/package/file-type). For applications that cannot immediately patch, implement input validation by rejecting MKV files from untrusted sources or restricting file-type detection to a separate, resource-limited process with timeouts to prevent application-wide unresponsiveness. Monitor the vendor releases at https://github.com/sindresorhus/file-type/releases/tag/v16.5.4 and https://github.com/sindresorhus/file-type/releases/tag/v17.1.3 for confirmation of patch availability.