CVE-2026-17514: node-unzipper Path Traversal Vulnerability

CVE-2026-17514 Overview

CVE-2026-17514 is a path traversal vulnerability [CWE-22] affecting the ZJONSSON node-unzipper library up to version 0.12.3. The flaw resides in the Extract function of lib/extract.js. An attacker with local access can craft archive entries that escape the intended extraction directory. The exploit has been publicly disclosed. The maintainer was notified through a GitHub issue but has not responded at the time of publication.

Critical Impact
Local attackers can write files outside the target extraction directory by supplying a crafted ZIP archive, potentially overwriting configuration or executable files processed by applications that depend on node-unzipper.

Affected Products

ZJONSSON node-unzipper versions up to and including 0.12.3
Node.js applications that call the Extract function from lib/extract.js
Downstream packages bundling vulnerable versions of node-unzipper

Discovery Timeline

2026-07-27 - CVE-2026-17514 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-17514

Vulnerability Analysis

The node-unzipper library provides streaming ZIP extraction for Node.js applications. The Extract function in lib/extract.js writes archive entries to a caller-specified directory. The function does not sufficiently validate entry names before joining them with the destination path.

An attacker who controls the contents of a ZIP archive can include entries whose names contain ../ sequences or absolute paths. When the vulnerable Extract function processes these entries, file writes resolve to locations outside the intended output directory. The attack requires local access to supply the malicious archive to a process that invokes the extraction routine.

Root Cause

The root cause is insufficient sanitization of archive entry file names, classified as improper limitation of a pathname to a restricted directory [CWE-22]. The Extract function trusts entry names embedded in the ZIP central directory. Because ZIP entries can encode traversal sequences or absolute paths, the resulting write path escapes the extraction root.

Attack Vector

Exploitation requires local access and low privileges. The attacker crafts a ZIP archive containing entries with names such as ../../etc/target or platform-specific traversal payloads. When a host application invokes Extract on the archive, the library writes attacker-controlled content to the traversed path. Impact is bounded by the file system privileges of the Node.js process executing the extraction. Refer to the VulDB Vulnerability Report and the GitHub Issue Discussion for additional technical details.

Detection Methods for CVE-2026-17514

Indicators of Compromise

Files written outside the intended extraction directory during or immediately after ZIP processing by a Node.js process.
ZIP archives containing entry names with ../ sequences, backslash traversal, or absolute paths.
Unexpected modifications to configuration files, startup scripts, or web roots on hosts running services that depend on node-unzipper.

Detection Strategies

Inventory Node.js projects with Software Composition Analysis to identify installations of node-unzipper at or below version 0.12.3.
Statically scan application code for calls to the Extract function in lib/extract.js and flag paths without post-extraction validation.
Inspect archives at ingestion by enumerating entry names and rejecting any containing .., leading /, or drive letters.

Monitoring Recommendations

Enable file integrity monitoring on directories adjacent to extraction targets, including parent paths, to catch traversal writes.
Log the working directory, target extraction path, and archive source for each invocation of the extraction routine.
Alert on Node.js processes writing to unexpected locations such as /etc, service configuration directories, or user profile startup folders.

How to Mitigate CVE-2026-17514

Immediate Actions Required

Identify all applications and container images that bundle node-unzipper version 0.12.3 or earlier.
Restrict who can supply ZIP archives to services that call Extract, and treat all archive input as untrusted.
Run Node.js extraction workloads under a least-privilege service account with no write access to sensitive directories.

Patch Information

At the time of publication, the maintainer has not responded to the reported issue, and no fixed release has been announced. Track the GitHub Issue Discussion and the GitHub Project Repository for a security update. Consider migrating to an actively maintained ZIP extraction library if a patch is not released in a timely manner.

Workarounds

Wrap calls to Extract with a validation step that resolves each entry path and rejects any that escape the target directory root.
Extract archives to a disposable sandbox directory, then move validated files to their destination.
Reject archives whose entries contain .., absolute paths, or symbolic links before extraction proceeds.
Run extraction inside a container or chroot with read-only mounts on sensitive paths.

bash

# Configuration example: validate resolved paths before writing
# Pseudocode guard for applications calling node-unzipper Extract
# node -e 'const path = require("path");
#   const root = path.resolve("./safe-extract");
#   const target = path.resolve(root, entry.path);
#   if (!target.startsWith(root + path.sep)) throw new Error("path traversal blocked");'