Bug 2560020 (CVE-2026-106070)

Summary: CVE-2026-106070 nodejs: Node.js: Security inspection bypass via crafted ZIP archive header mismatch
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: gtanzill, jbuscemi, kaycoth, rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Node.js zlib.ZipFile API. After local and central ZIP header validation fails, reading zipEntry.modified (directly or while compacting) can leave a parsed local header cached without a content offset. A later content read may then return attacker-controlled bytes from the start of the archive instead of rejecting it, while CRC-32 verification can still pass because the attacker controls the central directory CRC. A Node.js-based scanner using ZipFile could therefore accept different content than another ZIP implementation extracts from the same archive. This API was introduced in the Node.js 26.x line.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2560633    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-23 16:22:45 UTC 
A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails.

When `zipEntry.modified` is read on an archive whose local header does not match its central directory, either directly or while compacting the archive, the validation error is caught but the parsed local header is left cached without a content offset. A later content read then returns attacker-controlled bytes from the start of the file instead of rejecting the archive, and CRC-32 verification still passes because the attacker controls the central directory CRC. A Node.js-based scanner can therefore approve different content from what another ZIP implementation extracts from the same archive.

This vulnerability affects Node.js **26.x**.