EUVD-2026-109099
GHSA-c2qw-fgxm-vxx4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted ZIP to Node.js app
-
ExploitInvalid local headers parsed by zlib
-
ExecutionInvalid headers cached incorrectly
-
ImpactLater archive data misinterpreted (integrity impact)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Business logic errors
|
| Exploitation Conditions | Exploitation requires that an application built on Node.js 26.12.0 feed attacker-influenced ZIP/zlib input through Node's zlib handling so that invalid ZIP local headers are encountered and cached; it is not triggerable merely by running Node without processing such data. Limiting factors: the CVSS AC:H indicates non-trivial conditions to trigger the flaw, impact is confined to low integrity (C:N/A:N, scope unchanged), only Node.js 26.12.0 is listed as affected, and the exact header pattern needed is not described in the available sources. These constraints, together with the vendor 'Low' rating and 'monitor' decision label, make real-world risk minor and situational. |
| Impact | This is a genuinely low-priority issue, and the available signals agree rather than conflict. The Node.js project itself rated CVE-2026-106070 (zlib: avoid caching invalid ZIP local headers) as 'Low' severity, the vuln.today decision label is 'monitor' (not act_now/emergency), and the official CVSS:3.0 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) yields only 3.7. The vector shows no confidentiality or availability impact and only low integrity impact, with high attack complexity. There is no CISA KEV listing, no EPSS score supplied, and no PoC or exploit reference attached to this specific CVE in the input, so exploitation status is 'no public exploit identified at time of analysis.' Note two metadata tensions: the vector is C:N/I:L yet the tag reads 'Information Disclosure,' which does not match an integrity-only impact; and the 'Canonical' tag appears to belong to the sibling CVEs in the same release about rejecting non-canonical IP addresses rather than to this zlib issue - verify tagging before using it to drive automation. CWE-840 (business-logic error) and the terse changelog line are all the mechanism detail provided; the actual trigger is not described in the available sources, so the realistic risk is best treated as a minor correctness/integrity defect rather than an urgent threat. |
| Exploit ScenarioDerived | An application running Node.js 26.12.0 processes attacker-supplied ZIP/zlib data, and a maliciously crafted archive with invalid ZIP local headers causes Node's zlib handling to cache those invalid headers, leading to incorrect parsing results. The high attack complexity (AC:H) and integrity-only, low impact mean a successful attempt at most corrupts how later data is interpreted; no PoC or exploit code is referenced in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 23, 2026
Node.js 26.12.0 can cache invalid ZIP local headers within its zlib handling, so an application that passes attacker-influenced ZIP or zlib data through those APIs may end up with corrupted header state affecting integrity of subsequently processed data. The vendor rates this Low, scope is unchanged, and only integrity impact is assessed (C:N/I:L/A:N) with high attack complexity, meaning exploitation depends on specific application behavior rather than merely running Node.js. The fix ships in Node.js 26.12.1; no public exploit code has been confirmed at time of analysis and EPSS/KEV signals are absent from the available data.
RemediationAI
Vendor-released patch: upgrade Node.js to 26.12.1, the 2026-10-21 security release that contains the zlib fix (release notes: https://github.com/nodejs/node/releases/tag/v26.12.1; advisory: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases). Because only 26.12.0 is listed as affected and the reference points to the Current line, confirm whether your deployment tracks that branch and plan the upgrade accordingly; other fixes in the same release include several High-severity TLS, DNS and Brotli changes, so bundling the upgrade is worthwhile. Where upgrading is delayed, the exposure is bounded by application behavior rather than by Node.js itself: review any code path that passes untrusted archives or compressed payloads to zlib/ZIP handling on 26.12.0, and avoid feeding unvalidated third-party ZIP data through it, since the vendor rates this Low and the assessed impact is limited to low integrity. Updating to 26.12.1 is the complete fix; no separate workaround is documented in the supplied sources.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue lives in Node.js's zlib subsystem, the binding layer over the bundled zlib library that also parses ZIP container structures such as local file headers. The assigned CWE-840 (Business Logic Errors) points to a flawed caching decision: the implementation retains header state derived from a ZIP local header without sufficiently establishing that the header is valid, so malformed input can influence state that persists beyond the immediate operation. Because the flaw is a logic/state-handling defect rather than memory corruption, the assessed impact is limited to low integrity with no confidentiality or availability effect and no scope change; the CVSS AC:H metric reflects non-trivial preconditions, and the supplied sources do not describe the exact malformed header pattern or code path required. Affected scope per the vendor advisory data is Node.js 26.12.0 (EUVD lists 26.12.0 ≤26.12.0), and the issue was addressed as part of the 2026-10-21 security release alongside several unrelated High and Medium fixes.
Know when Node.js gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Attacker-supplied archive data reaches zlib remotely (AV:N, PR:N, UI:N); specific invalid-header conditions give AC:H; impact is limited to data-integrity (I:L) with no confidentiality or availability effect.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
2Description PRE-NVD
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote code execution in n8n's workflow expression evaluation system allows an authenticated user with workflow creation
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
Exploit-DB