CVE-2026-106070

A flaw in the Node.js zlib.ZipFile API affects version 26.x . When reading an archive where the local header fails validation against the central directory, the parsed local header is cached without a content offset. This allows a subsequent content read to return attacker-controlled bytes from t...