CVE-2026-106070

What it actually does

The zlib.ZipFile implementation in Node.js 26.x caches a parsed local header lacking a valid content offset after catching a header mismatch validation error; subsequent reads return attacker-controlled bytes from the file start while the attacker-supplied central-directory CRC still passes verification, causing the API to surface content that differs from what other ZIP parsers extract.

Why it matters to the business

Organizations relying on Node.js 26.x for ZIP processing in scanners, archivers, or build pipelines risk inconsistent file handling that can silently approve altered or malicious archives, leading to supply-chain integrity failures and potential bypass of automated security checks.

How an attack unfolds

An attacker crafts a ZIP archive whose local header does not match the central directory, supplies a matching CRC-32 in the central directory, and triggers either direct modified-property access or archive compaction; the validation error is swallowed, the malformed header remains cached, and a later content read returns attacker-chosen bytes from the file beginning instead of rejecting the entry.

How to fix it

Upgrade to a patched Node.js release that correctly rejects mismatched ZIP headers and clears cached state on validation failure; until a fix is available, replace zlib.ZipFile usage with a well-tested third-party ZIP library that enforces strict header consistency checks.

How to confirm the fix worked

Test affected code paths with ZIP archives containing deliberately mismatched local and central headers; confirm that the patched version raises a validation error and returns no content instead of attacker-controlled bytes, and that CRC verification fails for tampered central directories.

Typical attack path

1. Craft a ZIP archive with mismatched local and central headers but attacker-controlled CRC values
2. Deliver the archive to a Node.js 26.x application that uses zlib.ZipFile
3. Trigger header validation (via modified access or compaction)
4. Cause a subsequent content read that returns bytes from the file start
5. Obtain approval or extraction of different content than other ZIP implementations would produce

How to detect it

Review application logs for ZIP processing errors that are caught and ignored, followed by successful content reads on the same archive; look for unusual file-start byte sequences appearing in extracted or scanned output where header validation was previously triggered.

What your security team should do

• Inventory all Node.js 26.x deployments that process untrusted ZIP archives
• Prioritize upgrade to the next Node.js maintenance release containing the fix
• Temporarily isolate or replace ZipFile-dependent scanning pipelines with alternative libraries
• Add runtime assertions that reject archives showing header mismatches before any content read