CVE-2026-32630: Sindresorhus File-type DoS Vulnerability

CVE-2026-32630 Overview

CVE-2026-32630 is a resource exhaustion vulnerability in the popular file-type npm package, which is used to detect file types from files, streams, or data buffers. The vulnerability affects versions 20.0.0 through 21.3.1 and allows attackers to trigger excessive memory growth during type detection by supplying a specially crafted ZIP file.

The issue occurs when using fileTypeFromBuffer(), fileTypeFromBlob(), or fileTypeFromFile() functions. While the ZIP inflate output limit is properly enforced for stream-based detection, it is not enforced for known-size inputs. This allows a small compressed ZIP file to cause file-type to inflate and process a disproportionately larger payload while probing ZIP-based formats such as OOXML (Office Open XML).

Critical Impact

Applications processing user-uploaded files using the file-type package may experience denial of service through memory exhaustion when handling malicious ZIP files.

Affected Products

• sindresorhus file-type versions 20.0.0 to 21.3.1
• Node.js applications using vulnerable file-type versions
• Applications processing ZIP or OOXML file uploads using file-type detection

Discovery Timeline

• 2026-03-16 - CVE CVE-2026-32630 published to NVD
• 2026-03-17 - Last updated in NVD database

Technical Details for CVE-2026-32630

Vulnerability Analysis

This vulnerability is classified as CWE-409: Improper Handling of Highly Compressed Data (Data Amplification). The root issue lies in an inconsistency in how the file-type library handles decompression limits across different input methods.

When file-type receives input via streaming APIs, it enforces an output limit on ZIP inflation to prevent memory exhaustion. However, when the same library processes known-size inputs through fileTypeFromBuffer(), fileTypeFromBlob(), or fileTypeFromFile(), this protective limit is bypassed. This creates an exploitable condition where attackers can craft a ZIP file with a high compression ratio (a "ZIP bomb" variant) that appears small but expands dramatically when processed.

The vulnerability is particularly concerning for applications that handle OOXML formats (.docx, .xlsx, .pptx), as these are ZIP-based and file-type must partially inflate them to determine the file type. An attacker could upload a seemingly innocuous Office document that triggers the memory exhaustion during type detection.

Root Cause

The vulnerability stems from missing output limit enforcement in the code paths handling non-stream inputs. The fileTypeFromBuffer(), fileTypeFromBlob(), and fileTypeFromFile() functions do not apply the same ZIP inflate output restrictions that protect the streaming API. This architectural inconsistency allows the inflation process to consume unbounded memory when processing maliciously crafted compressed data.

Attack Vector

The attack is network-exploitable and requires no authentication or user interaction. An attacker simply needs to submit a crafted ZIP file (or ZIP-based format like OOXML) to any application endpoint that uses the vulnerable file-type functions for file type detection. The attack could target:

• File upload handlers that validate file types before processing
• Content management systems detecting media types
• Document processing pipelines that inspect incoming files
• Any Node.js service using file-type for MIME type detection

The attack payload is a small, highly compressed ZIP file that inflates to a much larger size, causing memory growth proportional to the uncompressed content size rather than the input size.

Detection Methods for CVE-2026-32630

Indicators of Compromise

• Unusual memory consumption spikes in Node.js processes handling file uploads
• Process crashes due to out-of-memory errors when processing seemingly small ZIP or OOXML files
• Slow or unresponsive file processing endpoints
• Logs showing file-type operations timing out or failing during ZIP-based format detection

Detection Strategies

• Monitor Node.js process memory usage for sudden growth when processing uploaded files
• Implement file size validation before passing files to file-type detection functions
• Add logging around file-type function calls to correlate memory events with specific files
• Use application performance monitoring (APM) to track memory allocation patterns during file processing

Monitoring Recommendations

• Set up alerts for Node.js heap memory exceeding expected thresholds during file processing
• Monitor for repeated service restarts that could indicate DoS conditions
• Track file upload sizes versus processing memory consumption ratios
• Implement circuit breakers on file processing endpoints to prevent cascading failures

How to Mitigate CVE-2026-32630

Immediate Actions Required

• Upgrade the file-type package to version 21.3.2 or later immediately
• Review all code paths using fileTypeFromBuffer(), fileTypeFromBlob(), or fileTypeFromFile()
• Implement input file size limits before type detection
• Consider adding memory limits to Node.js processes handling file uploads as a defense-in-depth measure

Patch Information

The vulnerability is fixed in file-type version 21.3.2. The patch enforces consistent ZIP inflate output limits across all input methods, eliminating the disparity between stream-based and buffer-based detection. The fix is available via the GitHub commit 399b0f156063f5aeb1c124a7fd61028f3ea7c124.

For detailed information about the vulnerability and the fix, refer to the GitHub Security Advisory GHSA-j47w-4g3g-c36v.

Workarounds

• Implement strict file size limits (e.g., reject files over a reasonable threshold) before passing to file-type
• Use stream-based detection via fileTypeFromStream() which properly enforces output limits
• Add process-level memory limits using Node.js --max-old-space-size flag to contain potential memory exhaustion
• Consider pre-validating file extensions before invoking file-type detection as a first-pass filter

# Configuration example
# Update file-type to the patched version
npm update file-type@21.3.2

# Alternatively, install the specific patched version
npm install file-type@21.3.2 --save

# Set Node.js memory limits as defense-in-depth
node --max-old-space-size=512 app.js