Description
An issue was discovered in the file-type package before 16.5.4 and 17.x before 17.1.3 for Node.js. A malformed MKV file could cause the file type detector to get caught in an infinite loop. This would make the application become unresponsive and could be used to cause a DoS attack.
Scores
CVSS v3
5.5
EPSS
0.0017
EPSS Percentile
38.0%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Details
CWE
CWE-835
Status
published
Products (3)
file-type_project/file-type
< 16.5.4
npm/file-type
13.0.0 - 16.5.4npm
sindresorhus/file-type
< 16.5.4
Published
Jul 21, 2022
Tracked Since
Feb 18, 2026