CVE-2022-36313 file-type vulnerable to Infinite Loop via malformed MKV file

What is CVE-2022-36313?

CVE-2022-36313 is a medium-severity denial of service vulnerability in n/a, published on 21 Jul 2022. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

An issue was discovered in the file-type package before 16.5.4 and 17.x before 17.1.3 for Node.js. A malformed MKV file could cause the file type detector to get caught in an infinite loop. This would make the application become unresponsive and could be used to cause a DoS attack.

Weakness: CWE-835

Which versions are affected by CVE-2022-36313?

4 open source packages ship an affected version, including file-type. It affects 1 product.

Products include Sindresorhus File-Type.

How do I fix CVE-2022-36313?

Upgrade file-type to a fixed version for your release line: 16.5.4 or 17.1.3.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2022-36313 being exploited?

There is no known exploitation of CVE-2022-36313 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2026-32630 file-type affected by ZIP Decompression Bomb DoS via [Content_Types].xml entry Medium 5.3
• CVE-2026-31808 file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-header Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-mhxj-85r3-2x55, ROOT-APP-NPM-CVE-2022-36313.