CVE-2026-31808

What it actually does

CVE-2026-31808 is a denial-of-service flaw in the ASF/WMV/WMA parser used by the Node.js file-type package before version 21.3.1. When the parser processes a crafted ASF structure containing a sub-header size value of zero, its calculated payload length becomes negative. The parser then moves its tokenizer read position backwards and repeatedly reprocesses the same sub-header, creating an infinite loop. Because this occurs synchronously during file type detection, a very small attacker-controlled input can stall the Node.js event loop and prevent the affected process from handling other work.

Why it matters to the business

Applications that inspect uploaded files, email attachments, media files, API payloads, or other untrusted content with vulnerable versions of file-type can be made unavailable with a tiny crafted input. The main consequence is service disruption: web requests may hang, worker queues may stop progressing, upload pipelines may stall, and autoscaling may amplify cost without restoring service if each new process is fed the same payload. The CVSS score is moderate and EPSS is currently low, and it is not listed in CISA KEV, but the attack requires no authentication, no user interaction, and only a small malicious file, so internet-facing upload or content-processing paths should still be prioritized.

How an attack unfolds

An attacker identifies an application path that passes attacker-controlled bytes to file-type for type detection, such as a file upload endpoint, media ingestion service, document scanner, messaging attachment handler, or URL-fetch-and-inspect feature. The attacker submits a crafted ASF-like payload whose header structure causes the vulnerable ASF parser to read a sub-header with a zero size field. In affected versions, the parser computes a negative payload length and calls the tokenizer ignore operation in a way that moves the read cursor backwards. The same sub-header is then parsed repeatedly, causing an infinite loop inside the Node.js process. Since Node.js relies on a single event loop per process, this can block request handling, delay timers, prevent other uploads from completing, and make the service appear hung until the process is restarted or killed. Repeated submissions can sustain the outage across workers or restarted instances.

How to fix it

Upgrade the file-type package to version 21.3.1 or later wherever it is used, including direct and transitive dependencies. Regenerate and commit lockfiles after upgrading, then rebuild and redeploy affected applications, containers, serverless functions, and worker images. If immediate upgrade is not possible, mitigate by rejecting or quarantining ASF/WMV/WMA-like inputs before they reach file-type, enforcing strict upload size and request rate limits, processing untrusted file detection in isolated worker processes with execution timeouts, and terminating workers that exceed CPU or wall-clock thresholds. Avoid running file inspection for untrusted input on the same event loop that serves latency-sensitive user traffic.

How to confirm the fix worked

Confirm that dependency manifests and lockfiles resolve file-type to 21.3.1 or later. Use package-manager inspection commands such as npm ls file-type, pnpm why file-type, yarn why file-type, or software composition analysis tooling to find all direct and transitive copies. Validate deployed artifacts rather than only source repositories, because vulnerable versions can remain inside container images, bundled serverless packages, or vendored build outputs. Exercise file upload and ingestion paths in a controlled test environment with malformed media samples and verify that processing times out or rejects the input rather than hanging the Node.js process. Confirm that runtime safeguards detect and recover from event-loop stalls, high CPU, and long-running file inspection jobs.

Typical attack path

1. Find an exposed feature that accepts or retrieves untrusted files, streams, or buffers and performs file type detection.
2. Submit a crafted ASF/WMV/WMA-like payload containing a malformed sub-header with a zero size field.
3. Trigger the application path that invokes the vulnerable file-type parser before version 21.3.1.
4. Cause the parser to enter an infinite loop while processing the malicious input.
5. Keep the Node.js event loop occupied, causing requests, jobs, or ingestion workflows handled by that process to hang.
6. Repeat requests or target multiple workers to sustain denial of service.

How to detect it

Look for evidence of unexplained Node.js process hangs or CPU saturation occurring immediately after file upload, attachment processing, media ingestion, or remote file inspection activity. Useful sources include web access logs, API gateway logs, upload service logs, object-storage write events, worker queue telemetry, Node.js application logs, event-loop delay metrics, container or host CPU metrics, process restart records, crash-loop events, and load balancer timeout logs. Focus on requests that submitted very small files but caused long processing times, 499/502/503/504 responses, upstream timeout messages, stalled worker jobs, or manual process restarts. Preserve and inspect suspicious uploaded files for ASF/WMV/WMA header structures, especially malformed ASF objects with zero size fields. Because the vulnerability causes an infinite loop rather than a distinctive exception, absence of application error logs does not rule out exploitation. If threat hunting historical incidents, correlate spikes in event-loop lag or request timeouts with upload endpoints and with newly stored small binary files beginning with the ASF header GUID.

• file-type < 21.3.1
• node_modules/file-type/package.json
• "file-type": "21.3.0"
• "file-type": "21.2.
• "file-type": "21.1.
• "file-type": "21.0.
• 30 26 B2 75 8E 66 CF 11 A6 D9 00 AA 00 62 CE 6C
• application/vnd.ms-asf
• video/x-ms-wmv
• audio/x-ms-wma
• upstream timed out
• context deadline exceeded
• worker timeout
• event loop delay
• ELU exceeded
• CPU throttling
• CrashLoopBackOff

What your security team should do

• Inventory all Node.js services, workers, and serverless functions that use file-type directly or indirectly, especially those handling uploads, attachments, media ingestion, document processing, or remote file fetching.
• Upgrade file-type to 21.3.1 or later and redeploy all affected runtime artifacts.
• Prioritize internet-facing and unauthenticated upload paths first because exploitation requires no credentials and only a small crafted payload.
• Add timeouts, process isolation, and worker recycling around untrusted file inspection so parser bugs cannot block the main application event loop.
• Add rate limits and abuse controls to upload, attachment, and file-inspection endpoints.
• Monitor Node.js services for event-loop delay, sustained single-process CPU saturation, request timeouts, and worker restarts correlated with file upload or media processing requests.
• Search dependency lockfiles, container images, and SBOMs for vulnerable file-type versions and create a recurring dependency alert for this package.
• If suspicious availability incidents occurred, preserve uploaded files, request logs, worker logs, and process metrics for forensic review before cleanup.