Node.js CVE-2022-36313
MEDIUM
GHSA-mhxj-85r3-2x55
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Loop termination conditions
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | While the CVSS score of 5.5 and CWE-835 classification suggest meaningful impact, several risk signals indicate moderate real-world priority. The EPSS score of 0.17% (38th percentile) shows low empirical exploitation probability, suggesting this vulnerability has not been actively leveraged at scale. The attack vector is Local (AV:L) requiring user interaction (UI:R), limiting remote exploitation—an attacker must convince a user or application to process a malicious MKV file. The vulnerability is automatable (once a malformed MKV is crafted, it reliably triggers the issue) and causes availability loss (A:H) without confidentiality or integrity impact. Absence from known exploited vulnerabilities (KEV) data further supports low active exploitation. This represents a genuine but limited-scope risk best addressed through routine patch management rather than emergency response. |
| Exploit ScenarioDerived | An attacker crafts a malformed MKV file with a specially-constructed header that prevents proper loop termination during file type detection and uploads it to an application that uses the file-type library (e.g., a file sharing service or media platform). When the application attempts to identify the file type by passing the malformed MKV to the library, the parser enters an infinite loop, exhausting CPU resources and causing the application process to hang. Legitimate users experience degraded service or timeouts, resulting in denial of service. Since the attack requires only uploading a file and user interaction (the application's automated processing), it is highly practical for an attacker with network access to the vulnerable service. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 17, 2026
A malformed MKV file can trigger an infinite loop in the file-type Node.js package (versions before 16.5.4 and 17.x before 17.1.3), causing application unresponsiveness and enabling denial-of-service attacks. The vulnerability affects the Sindresorhus file-type library, a widely-used dependency for file type detection, and requires only local access and user interaction to trigger (CVSS 5.5). With an EPSS score of 0.17% (38th percentile), actual exploitation probability remains relatively low despite the moderate severity rating.
RemediationAI
Upgrade the file-type package to version 16.5.4 or later for the 16.x branch, or to version 17.1.3 or later for the 17.x branch. Users should update their package.json dependencies and run npm update or yarn upgrade to pull the patched versions from the npm registry (https://www.npmjs.com/package/file-type). For applications that cannot immediately patch, implement input validation by rejecting MKV files from untrusted sources or restricting file-type detection to a separate, resource-limited process with timeouts to prevent application-wide unresponsiveness. Monitor the vendor releases at https://github.com/sindresorhus/file-type/releases/tag/v16.5.4 and https://github.com/sindresorhus/file-type/releases/tag/v17.1.3 for confirmation of patch availability.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The file-type package is a popular Node.js library maintained by Sindresorhus used for detecting file types by examining magic bytes and file signatures. The vulnerability resides in the MKV (Matroska Video) file format parsing logic, where improper loop termination conditions allow a specially-crafted MKV header structure to cause infinite iteration. The root cause is classified under CWE-835 (Infinite Loop), indicating the parser fails to implement proper bounds checking or exit conditions when processing malformed MKV container structures. The affected CPE entries (cpe:2.3:a:sindresorhus:file-type:*:*:*:*:*:node.js:*:*) indicate the vulnerability exists across all versions prior to the patched releases in both the 16.x and 17.x release branches.
Know when Node.js gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
An issue was discovered in the file-type package before 16.5.4 and 17.x before 17.1.3 for Node.js. A malformed MKV file could cause the file type detector to get caught in an infinite loop. This would make the application become unresponsive and could be used to cause a DoS attack.
Executive ViewAI
Organizations using the file-type package should be aware of moderate risk from CVE-2022-36313 rated CVSS 5.5. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)NVD
Remote code execution in n8n's workflow expression evaluation system allows an authenticated user with workflow creation
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to cond
Exploit-DB