CVE-2026-106070

A flaw was found in the Node.js zlib.ZipFile API. After local and central ZIP header validation fails, reading zipEntry.modified directly or while compacting can leave a parsed local header cached without a content offset. A later content read may then return attacker-controlled bytes from the...