Node.js 26.12.0 ZipFile Invalid-Header Content Substitution

Node.js versions before 26.12.1 in the 26.x branch contain a ZipFile invalid-header content substitution flaw that can return attacker-controlled prefix bytes after failed ZIP header validation. This tool evaluates operator-supplied Node.js version evidence offline...