CVE-2026-31808
Denial of Service in file-type ASF Parser via Infinite Loop
Publication date: 2026-03-10
Last updated on: 2026-03-18
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sindresorhus | file-type | From 13.0.0 (inc) to 21.3.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-835 | The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the file-type library prior to version 21.3.1, specifically in the ASF (WMV/WMA) file type detection parser. When the parser processes a crafted input where an ASF sub-header has a size field set to zero, it causes an infinite loop. This happens because the payload value becomes negative (-24), which makes the tokenizer move the read position backwards repeatedly, causing the same sub-header to be read over and over again.
Any application using file-type to detect the type of untrusted or attacker-controlled input is affected by this issue.
How can this vulnerability impact me? :
An attacker can exploit this vulnerability by sending a crafted 55-byte payload that causes the Node.js event loop to stall indefinitely. This results in a denial of service (DoS) condition, where the affected application becomes unresponsive or unable to process further requests.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade the file-type package to version 21.3.1 or later, where the denial of service issue in the ASF file type detection parser has been fixed.
Avoid processing untrusted or attacker-controlled ASF (WMV/WMA) files with vulnerable versions of file-type to prevent stalling the Node.js event loop.