CVE-2026-114102High· 7.5▾ Twilightadm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.js process via a malformed ZIP file, because inflateAsync in methods/inflater.js lacks a zlib stream error listener. …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.js process via a malformed ZIP file, because inflateAsync in methods/inflater.js lacks a zlib stream error listener. Attackers can supply a ZIP with corrupted DEFLATE data processed by readFileAsync, readAsTextAsync, extractAllToAsync, or getDataAsync, triggering an uncatchable exception that terminates all in-flight requests.
adm-zip < 0.6.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
GHSA-8238-w5pm-2374High· 7.5adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)
CVE-2026-114103Medium· 5.3adm-zip 0.6.0 Decompression Bomb Guard Bypass via getDataAsync()
CVE-2026-114104Medium· 5.9adm-zip before 0.6.1 Duplicate ZIP Entry Name Validation Bypass
CVE-2026-114105Medium· 6.2Adm-zip before 0.6.1 Privilege Escalation via keepOriginalPermission Setuid Bits
CVE-2026-102282High· 7.1adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js
CVE-2026-77301High· 7.5adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js