CVE-2026-32630 file-type affected by ZIP Decompression Bomb DoS via [Content_Types].xml entry
Attackers can cause denial of service via excessive memory consumption when the library processes crafted ZIP files using buffer or blob detection methods.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-32630?
CVE-2026-32630 is a medium-severity denial of service vulnerability in sindresorhus file-type, published on 13 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
file-type detects the file type of a file, stream, or data. From 20.0.0 to 21.3.1, a crafted ZIP file can trigger excessive memory growth during type detection in file-type when using fileTypeFromBuffer(), fileTypeFromBlob(), or fileTypeFromFile(). The ZIP inflate output limit is enforced for stream-based detection, but not for known-size inputs. As a result, a small compressed ZIP can cause file-type to inflate and process a much larger payload while probing ZIP-based formats such as OOXML. This vulnerability is fixed in 21.3.2.
Weakness: CWE-409
Which versions are affected by CVE-2026-32630?
2 open source packages ship an affected version, including file-type. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
file-type npm | From 20.0.0 | 21.3.2 |
file-type npm | From 20.0.0 | 21.3.2 |
Products include Sindresorhus File-Type.
How do I fix CVE-2026-32630?
Upgrade file-type to 21.3.2 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-32630 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-32630 exists.
Other vulnerabilities in sindresorhus file-type
Sources
Also known as GHSA-j47w-4g3g-c36v, MINI-5fgc-hh74-w3j7, MINI-8ffp-6hfp-hp4x, MINI-cx7f-gw4m-8fr7, MINI-jp73-mxc3-vfmf, ROOT-APP-NPM-CVE-2026-32630.