Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-106070

Quick assessment

Affected
nodejs node
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Node.js 的 API 中存在一个缺陷：当本地文件头（local header）与中央目录（central directory）的验证失败后，该 API 仍可能返回不属于所请求条目的字节数据。 具体而言，当读取 属性时，若归档文件的本地文件头与其中央目录不匹配（无论是直接读取还是在压缩归档过程中），系统虽会捕获验证错误，但解析后的本地文件头仍会被缓存，且未设置内容偏移量。随后进行内容读取时，系统会从文件起始位置返回由攻击者控制的字节，而非拒绝该归档文件；同时，由于攻击者可控制中央目录中的 CRC-32 校验值，

AI Predicted 7.5 Difficulty: Easy

Possible ATT&CK Techniques 1 AI

T1203 · Exploitation for Client Execution

Affected Version Matrix 1

VendorProduct Version RangeStatus
nodejs node 26.12.0≤ 26.12.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-106070

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails. When `zipEntry.modified` is read on an archive whose local header does not match its central directory, either directly or while compacting the archive, the validation error is caught but the parsed local header is left cached without a content offset. A later content read then returns attacker-controlled bytes from the start of the file instead of rejecting the archive, and CRC-32 verification still passes because the attacker controls the central directory CRC. A Node.js-based scanner can therefore approve different content from what another ZIP implementation extracts from the same archive. This vulnerability affects Node.js **26.x**.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
业务逻辑错误
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
nodejs node 26.12.0 ~ 26.12.0 -

II. Public POCs for CVE-2026-106070

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-106070

请登录查看更多情报信息。

Security Blog Posts for CVE-2026-106070 (1)

Same Patch Batch · nodejs · 2026-10-23 · 9 CVEs total

CVE-2026-105481 Node.js 22/24/26.x HTTP 代理连接重用漏洞
CVE-2026-105482 Node.js 22/24/26.x DNS 解析空字节截断漏洞
CVE-2026-105483 Node.js 24.x/26.x TLS 主机验证绕过漏洞
CVE-2026-106074 Node.js 22/24/26 crypto 快照熵缓存漏洞
CVE-2026-106069 Node.js 22/24/26 TLS 主机验证漏洞
CVE-2026-106071 Node.js 26.x 权限模型文件系统漏洞
CVE-2026-106072 Node.js 22/24/26 TLS 主机验证绕过漏洞
CVE-2026-106073 Node.js 22/24/26 权限模型文件路径绕过漏洞

IV. Related Vulnerabilities

Same product: node
Same vendor: nodejs
Same weakness: CWE-840

V. Comments for CVE-2026-106070

No comments yet

Leave a comment