{"id":"CVE-2026-31808","aliases":["CLSA-2026-1781744121","CLSA-2026-1791199964","CLSA-2026-1793790371","EUVD-2026-10894","GHSA-5v7r-6r5c-r473","ROOT-APP-NPM-CVE-2026-31808"],"status":"published","title":"file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-header","description":"file-type detects the file type of a file, stream, or data. Prior to 21.3.1, a denial of service vulnerability exists in the ASF (WMV/WMA) file type detection parser. When parsing a crafted input where an ASF sub-header has a size field of zero, the parser enters an infinite loop. The payload value becomes negative (-24), causing tokenizer.ignore(payload) to move the read position backwards, so the same sub-header is read repeatedly forever. Any application that uses file-type to detect the type of untrusted/attacker-controlled input is affected. An attacker can stall the Node.js event loop with a 55-byte payload. Fixed in version 21.3.1.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00369,"percentile":0.31136,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-835"],"published":"2026-03-10T21:01:55Z","modified":"2026-11-04T14:45:06Z","fixes":[{"ecosystem":"npm","package":"file-type","fixed_in":["21.3.1"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"file-type","fixed_in":["17.1.6-tuxcare.1","16.5.4-tuxcare.1","10.11.0-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"file-type","fixed_in":["21.0.0-aikido.3","20.4.1-aikido.2","16.5.4-aikido.1","20.5.0-aikido.1","21.1.0-aikido.1","21.1.1-aikido.1","16.5.4-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/file-type","fixed_in":["21.0.0-root.io.2","20.4.1-root.io.1","21.0.0-root.io.3","20.4.1-root.io.2","16.5.4-root.io.1","20.5.0-root.io.1","21.1.0-root.io.1","21.1.1-root.io.1","16.5.4-root.io.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"file-type","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.0.0"},{"fixed":"21.3.1"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"file-type","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17.1.6-tuxcare.0"},{"fixed":"17.1.6-tuxcare.1"}]}],"versions":["17.1.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"file-type","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.5.4-tuxcare.0"},{"fixed":"16.5.4-tuxcare.1"}]}],"versions":["16.5.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"file-type","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.11.0-tuxcare.0"},{"fixed":"10.11.0-tuxcare.1"}]}],"versions":["10.11.0"]},{"source":"osv","ecosystem":"npm","package":"file-type","ranges":[{"type":"SEMVER","events":[{"introduced":"13.0.0"},{"fixed":"21.3.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"file-type","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.0.0-aikido.3"},{"fixed":"20.4.1-aikido.2"},{"fixed":"16.5.4-aikido.1"},{"fixed":"20.5.0-aikido.1"},{"fixed":"21.1.0-aikido.1"},{"fixed":"21.1.1-aikido.1"},{"fixed":"16.5.4-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/file-type","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.0.0-root.io.2"},{"fixed":"20.4.1-root.io.1"},{"fixed":"21.0.0-root.io.3"},{"fixed":"20.4.1-root.io.2"},{"fixed":"16.5.4-root.io.1"},{"fixed":"20.5.0-root.io.1"},{"fixed":"21.1.0-root.io.1"},{"fixed":"21.1.1-root.io.1"},{"fixed":"16.5.4-root.io.2"}]}]}],"products":[{"vendor":"sindresorhus","product":"file-type"}],"references":[{"url":"https://github.com/sindresorhus/file-type/security/advisories/GHSA-5v7r-6r5c-r473","tags":["x_refsource_CONFIRM","Mitigation","Patch","Vendor Advisory","advisory","web"]},{"url":"https://github.com/sindresorhus/file-type/commit/319abf871b50ba2fa221b4a7050059f1ae096f4f","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31808","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-5v7r-6r5c-r473"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31808.json","tags":["advisory"]},{"url":"https://github.com/sindresorhus/file-type","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-31808","title":"file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-header","description":"file-type detects the file type of a file, stream, or data. Prior to 21.3.1, a denial of service vulnerability exists in the ASF (WMV/WMA) file type detection parser. When parsing a crafted input where an ASF sub-header has a size field of zero, the parser enters an infinite loop. The payload value becomes negative (-24), causing tokenizer.ignore(payload) to move the read position backwards, so the same sub-header is read repeatedly forever. Any application that uses file-type to detect the type of untrusted/attacker-controlled input is affected. An attacker can stall the Node.js event loop with a 55-byte payload. Fixed in version 21.3.1.","status":"published","published":"2026-03-10T21:01:55.466Z","modified":"2026-03-11T16:00:14.754Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:19:50.92611Z"}],"euvd":[{"id":"EUVD-2026-10894","description":"file-type detects the file type of a file, stream, or data. Prior to 21.3.1, a denial of service vulnerability exists in the ASF (WMV/WMA) file type detection parser. When parsing a crafted input where an ASF sub-header has a size field of zero, the parser enters an infinite loop. The payload value becomes negative (-24), causing tokenizer.ignore(payload) to move the read position backwards, so the same sub-header is read repeatedly forever. Any application that uses file-type to detect the type of untrusted/attacker-controlled input is affected. An attacker can stall the Node.js event loop with a 55-byte payload. Fixed in version 21.3.1.","status":"published","published":"2026-03-10T21:01:55Z","modified":"2026-03-11T16:00:14Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T19:25:37.250097Z"}],"ghsa":[{"id":"GHSA-5v7r-6r5c-r473","title":"file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-header","description":"### Impact\nA denial of service vulnerability exists in the ASF (WMV/WMA) file type detection parser. When parsing a crafted input where an ASF sub-header has a `size` field of zero, the parser enters an infinite loop. The `payload` value becomes negative (-24), causing `tokenizer.ignore(payload)` to move the read position backwards, so the same sub-header is read repeatedly forever.\n\nAny application that uses `file-type` to detect the type of untrusted/attacker-controlled input is affected. An attacker can stall the Node.js event loop with a 55-byte payload.\n\n### Patches\nFixed in version 21.3.1. Users should upgrade to \u003e= 21.3.1.\n\n### Workarounds\nValidate or limit the size of input buffers before passing them to `file-type`, or run file type detection in a worker thread with a timeout.\n\n### References\n- Fix commit: 319abf871b50ba2fa221b4a7050059f1ae096f4f\n\n### Reporter\n\ncrnkovic@lokvica.com","status":"published","published":"2026-03-10T23:57:09Z","modified":"2026-03-10T23:57:11Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:39:34.616253Z"}],"nvd":[{"id":"CVE-2026-31808","description":"file-type detects the file type of a file, stream, or data. Prior to 21.3.1, a denial of service vulnerability exists in the ASF (WMV/WMA) file type detection parser. When parsing a crafted input where an ASF sub-header has a size field of zero, the parser enters an infinite loop. The payload value becomes negative (-24), causing tokenizer.ignore(payload) to move the read position backwards, so the same sub-header is read repeatedly forever. Any application that uses file-type to detect the type of untrusted/attacker-controlled input is affected. An attacker can stall the Node.js event loop with a 55-byte payload. Fixed in version 21.3.1.","status":"published","published":"2026-03-10T21:16:50.173Z","modified":"2026-06-17T10:34:30.063Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:12:08.98071Z"}],"osv":[{"id":"CVE-2026-31808","title":"file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-header","description":"file-type detects the file type of a file, stream, or data. Prior to 21.3.1, a denial of service vulnerability exists in the ASF (WMV/WMA) file type detection parser. When parsing a crafted input where an ASF sub-header has a size field of zero, the parser enters an infinite loop. The payload value becomes negative (-24), causing tokenizer.ignore(payload) to move the read position backwards, so the same sub-header is read repeatedly forever. Any application that uses file-type to detect the type of untrusted/attacker-controlled input is affected. An attacker can stall the Node.js event loop with a 55-byte payload. Fixed in version 21.3.1.","status":"published","published":"2026-03-10T21:01:55.466Z","modified":"2026-10-28T02:30:49.698453613Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T15:45:01.218144Z"},{"id":"GHSA-5v7r-6r5c-r473","title":"file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-header","description":"### Impact\nA denial of service vulnerability exists in the ASF (WMV/WMA) file type detection parser. When parsing a crafted input where an ASF sub-header has a `size` field of zero, the parser enters an infinite loop. The `payload` value becomes negative (-24), causing `tokenizer.ignore(payload)` to move the read position backwards, so the same sub-header is read repeatedly forever.\n\nAny application that uses `file-type` to detect the type of untrusted/attacker-controlled input is affected. An attacker can stall the Node.js event loop with a 55-byte payload.\n\n### Patches\nFixed in version 21.3.1. Users should upgrade to \u003e= 21.3.1.\n\n### Workarounds\nValidate or limit the size of input buffers before passing them to `file-type`, or run file type detection in a worker thread with a timeout.\n\n### References\n- Fix commit: 319abf871b50ba2fa221b4a7050059f1ae096f4f\n\n### Reporter\n\ncrnkovic@lokvica.com","status":"published","published":"2026-03-10T23:57:09Z","modified":"2026-09-10T03:50:37.674187908Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T15:46:38.911014Z"},{"id":"ROOT-APP-NPM-CVE-2026-31808","title":"CVE-2026-31808 in file-type - Patched by Root","description":"Root has patched CVE-2026-31808 in the file-type package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-09-29T12:27:01Z","modified":"2026-09-29T13:15:03.622507581Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:27.649662Z"},{"id":"CLSA-2026-1781744121","title":"TuxCare security update for file-type (1 CVE)","description":"TuxCare rebuilt file-type to address 1 CVE. Fixed in 17.1.6-tuxcare.1.","status":"published","published":"2026-08-04T14:52:37Z","modified":"2026-10-15T09:45:56.538636967Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1791199964","title":"TuxCare security update for file-type (1 CVE)","description":"TuxCare rebuilt file-type to address 1 CVE. Fixed in 16.5.4-tuxcare.1.","status":"published","published":"2026-10-05T11:32:44Z","modified":"2026-10-15T09:47:39.244595114Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1793790371","title":"TuxCare security update for file-type (1 CVE)","description":"TuxCare rebuilt file-type to address 1 CVE. Fixed in 10.11.0-tuxcare.1.","status":"published","published":"2026-11-04T12:06:12Z","modified":"2026-11-04T14:45:06.628931581Z","updated_at":"2026-11-04T15:03:54.132276Z"}]}}