Skip to main content
cve.nowby Sazabi
← npm
npmPackage

file-type

3 known vulnerabilities (3 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
3 · 3 medium
Registry
npm

Advisories 3

  • CVE-2026-32630Medium 5.3

    file-type affected by ZIP Decompression Bomb DoS via [Content_Types].xml entry

    Affected: from 20.0.0, fixed in 21.3.2.

  • CVE-2026-31808Medium 5.3

    file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-header

    Affected: from 13.0.0, fixed in 21.3.1.

  • CVE-2022-36313Medium 5.5

    An issue was discovered in the file-type package before 16.5.4 and 17.x before 17.1.3 for Node.js.

    Affected: from 13.0.0, fixed in 16.5.4; from 17.0.0, fixed in 17.1.3.