CVE-2026-31808 Details
Description
file-type detects the file type of a file, stream, or data. Prior to 21.3.1, a denial of service vulnerability exists in the ASF (WMV/WMA) file type detection parser. When parsing a crafted input where an ASF sub-header has a size field of zero, the parser enters an infinite loop. The payload value becomes negative (-24), causing tokenizer.ignore(payload) to move the read position backwards, so the same sub-header is read repeatedly forever. Any application that uses file-type to detect the type of untrusted/attacker-controlled input is affected. An attacker can stall the Node.js event loop with a 55-byte payload. Fixed in version 21.3.1.
A denial-of-service vulnerability has been identified in the file-type library, specifically in versions prior to 21.3.1. The issue arises in the ASF (WMV/WMA) file type detection parser, where a crafted input with a zero-size sub-header causes the parser to enter an infinite loop. This occurs because the size field's payload value becomes negative, leading the tokenizer to reverse the read position and repeatedly process the same sub-header. Applications using file-type to analyze untrusted or attacker-controlled data are susceptible to this vulnerability, which can stall the Node.js event loop.
Users are advised to upgrade to file-type version 21.3.1 or later. Additionally, input buffers can be validated or limited in size before being processed by file-type, or file type detection can be performed in a worker thread with a timeout.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/sindresorhus/file-type/commit/319abf871b50ba2fa221b4a7050059f1ae096f4f | [email protected] | Patch |
| https://github.com/sindresorhus/file-type/security/advisories/GHSA-5v7r-6r5c-r473 | [email protected] | MitigationPatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-835 | Loop with Unreachable Exit Condition ('Infinite Loop') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| sindresorhus file-type | >= 13.0.0, < 21.3.1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 18, 2026 | Initial Analysis | [email protected] |
| Mar 10, 2026 | New CVE Received | [email protected] |