nodejs
diff --git a/‎lib/internal/zip/archive.js‎
Lines changed: 7 additions & 4 deletions b/‎lib/internal/zip/archive.js‎
Lines changed: 7 additions & 4 deletions
@@ -133,12 +133,15 @@ async function* fileEntries(files, followSymlinks) {
       // would let a symlink swapped in after the classification above redirect
       // the read - a TOCTOU that defeats followSymlinks:false. O_NOFOLLOW makes
       // a final-component symlink fail the open outright when not following;
-      // the fstat then confirms a regular file, never a FIFO, device, or
-      // socket (which as a stream source could block or emit unbounded data).
+      // O_NONBLOCK keeps the open itself from blocking on a FIFO or a slow
+      // device (it has no effect on a regular file's reads), so the fstat can
+      // then reject anything that is not a regular file - a FIFO, device, or
+      // socket, which as a stream source could block or emit unbounded data.
       // Metadata comes from that same fstat so it describes the inode we read.
-      const flags = followSymlinks ?
+      const flags = (followSymlinks ?
         fs.constants.O_RDONLY :
-        fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW || 0);
+        fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW || 0)) |
+        (fs.constants.O_NONBLOCK || 0);
       const handle = await fs.promises.open(sourcePath, flags);
       let ownsHandle = true;
       try {