node/node CVE-2026-106070: low
Node.js ZipFile returns attacker-controlled prefix bytes after failed ZIP header validation
Action: Upgrade node to 26.12.1 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 26.0.0 | 26.12.1 | - |
Fixed versions
| 26.12.1 |
Sources
- node-runtime: CVE-2026-106070
CVE-2026-106070 · published · modified · JSON