CVE-2026-106070 nodejs CVE debrief

Who should care

Node.js 26.x deployment administrators and security teams should assess exposure to potentially malicious ZIP archives and verify affected systems. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. They should also plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Why it matters

Defenders should prioritize verifying affected Node.js 26.x deployments and assessing exposure to potentially malicious ZIP archives due to the vulnerability in the `zlib.ZipFile` API.

• Verification of Node.js 26.x deployments for exposure to potentially malicious ZIP archives is required
• Assessment of the impact on Node.js-based systems is necessary

Technical summary

The vulnerability in Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after local and central header validation fails. This occurs when `zipEntry.modified` is read on an archive whose local header does not match its central directory. The validation error is caught but the parsed local header is left cached without a content offset. A later content read then returns attacker-controlled bytes from the start of the file instead of rejecting the archive, and CRC-32 verification still passes because the attacker controls the central directory CRC. A Node.js-based scanner can therefore approve different content from what another ZIP implementation extracts from the

Defensive priority

Defenders should prioritize verifying affected Node.js 26.x deployments and assessing exposure to potentially malicious ZIP archives.

Recommended defensive actions

• Verify Node.js 26.x deployments for exposure to potentially malicious ZIP archives
• Assess the impact of the vulnerability on Node.js-based systems
• Monitor Node.js security releases for updates on this vulnerability
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Node.js `zlib.ZipFile` API. The Node.js security releases blog post provides additional context. The vulnerability affects Node.js 26.x and can cause it to return bytes that do not belong to the requested entry after local and central header validation fails. The local header and central directory CRC-32 verification can pass even when an attacker controls the central directory CRC. The vulnerability can be triggered when `zipEntry.modified` is read on an archive. To

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.