CVE-2026-31988 (Medium) detected in yauzl-2.10.0.tgz

[mend-bolt-for-github]

CVE-2026-31988 - Medium Severity Vulnerability

Vulnerable Library - yauzl-2.10.0.tgz

yet another unzip library for node

Library home page: https://registry.npmjs.org/yauzl/-/yauzl-2.10.0.tgz

Path to dependency file: /ui/package.json

Path to vulnerable library: /ui/node_modules/.pnpm/yauzl@2.10.0/node_modules/yauzl/package.json

Dependency Hierarchy:

• @postgres.ai/ce-4.0.3.tgz (Root Library)
  • cypress-14.5.4.tgz
    • ❌ yauzl-2.10.0.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

yauzl (aka Yet Another Unzip Library) version 3.2.0 for Node.js contains an off-by-one error in the NTFS extended timestamp extra field parser within the getLastModDate() function. The while loop condition checks cursor < data.length + 4 instead of cursor + 4 <= data.length, allowing readUInt16LE() to read past the buffer boundary. A remote attacker can cause a denial of service (process crash via ERR_OUT_OF_RANGE exception) by sending a crafted zip file with a malformed NTFS extra field. This affects any Node.js application that processes zip file uploads and calls entry.getLastModDate() on parsed entries. Fixed in version 3.2.1.

Publish Date: 2026-03-11

URL: CVE-2026-31988

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.codeant.ai/security-research/yauzl-denial-of-service-zip-file-crash

Release Date: 2026-03-11

Fix Resolution: yauzl - 3.2.1,https://github.com/thejoshwolfe/yauzl.git - 3.2.1

---

Step up your Open Source Security Game with Mend here

[mend-bolt-for-github]

✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

[mend-bolt-for-github]

ℹ️ This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.