{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-05-09T05:15:49.998","vulnerabilities":[{"cve":{"id":"CVE-2026-31808","sourceIdentifier":"security-advisories@github.com","published":"2026-03-10T21:16:50.173","lastModified":"2026-03-18T19:48:13.733","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"file-type detects the file type of a file, stream, or data. Prior to 21.3.1, a denial of service vulnerability exists in the ASF (WMV/WMA) file type detection parser. When parsing a crafted input where an ASF sub-header has a size field of zero, the parser enters an infinite loop. The payload value becomes negative (-24), causing tokenizer.ignore(payload) to move the read position backwards, so the same sub-header is read repeatedly forever. Any application that uses file-type to detect the type of untrusted/attacker-controlled input is affected. An attacker can stall the Node.js event loop with a 55-byte payload. Fixed in version 21.3.1."},{"lang":"es","value":"file-type detecta el tipo de archivo de un archivo, flujo o datos. Antes de 21.3.1, existe una vulnerabilidad de denegación de servicio en el analizador de detección de tipo de archivo ASF (WMV/WMA). Al analizar una entrada manipulada donde un subencabezado ASF tiene un campo de tamaño de cero, el analizador entra en un bucle infinito. El valor de la carga útil se vuelve negativo (-24), haciendo que tokenizer.ignore(payload) mueva la posición de lectura hacia atrás, por lo que el mismo subencabezado se lee repetidamente para siempre. Cualquier aplicación que utiliza file-type para detectar el tipo de entrada no confiable/controlada por el atacante se ve afectada. Un atacante puede paralizar el bucle de eventos de Node.js con una carga útil de 55 bytes. Corregido en la versión 21.3.1."}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-835"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:sindresorhus:file-type:*:*:*:*:*:node.js:*:*","versionStartIncluding":"13.0.0","versionEndExcluding":"21.3.1","matchCriteriaId":"6A5F1C18-775C-4C3E-B4D7-332961814056"}]}]}],"references":[{"url":"https://github.com/sindresorhus/file-type/commit/319abf871b50ba2fa221b4a7050059f1ae096f4f","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/sindresorhus/file-type/security/advisories/GHSA-5v7r-6r5c-r473","source":"security-advisories@github.com","tags":["Mitigation","Patch","Vendor Advisory"]}]}}]}