Is CVE-2026-31988 actively exploited?

No active exploitation of CVE-2026-31988 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-31988 be exploited remotely?

Yes. CVE-2026-31988 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-31988?

CVE-2026-31988 has a CVSS score of 5.3 (MEDIUM).

HOME VULNERABILITIESCVE-2026-31988

MEDIUM

CVE-2026-31988

CWE-193Published: March 11, 2026· Updated: Mar 12, 2026

5.3

CVSS v3.1

EPSS:0.10%probability of exploitation in 30 daysPercentile:27.8th

Official Description

yauzl (aka Yet Another Unzip Library) version 3.2.0 for Node.js contains an off-by-one error in the NTFS extended timestamp extra field parser within the getLastModDate() function. The while loop condition checks cursor < data.length + 4 instead of cursor + 4 <= data.length, allowing readUInt16LE() to read past the buffer boundary. A remote attacker can cause a denial of service (process crash via ERR_OUT_OF_RANGE exception) by sending a crafted zip file with a malformed NTFS extra field. This affects any Node.js application that processes zip file uploads and calls entry.getLastModDate() on parsed entries. Fixed in version 3.2.1.

NVD Source

Technical Analysis

CVE-2026-31988 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.