CVE-2026-114103Medium· 5.3▾ Sunlitadm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the maxOutputLength guard by targeting the asynchronous getDataAsync() path in methods/inflater.js. Attackers can craft ZIP entries with falsifi…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the maxOutputLength guard by targeting the asynchronous getDataAsync() path in methods/inflater.js. Attackers can craft ZIP entries with falsified small declared sizes and high-ratio DEFLATE payloads to exhaust memory in applications reading entries asynchronously.
adm-zip >= 0.6.0 < 0.6.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
GHSA-c6fg-446q-cg94Medium· 5.3adm-zip: getDataAsync() bypasses the maxOutputLength size guard enforced by the synchronous getData() path
GHSA-8238-w5pm-2374High· 7.5adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)
CVE-2026-114104Medium· 5.9adm-zip before 0.6.1 Duplicate ZIP Entry Name Validation Bypass
CVE-2026-114102High· 7.5adm-zip before 0.6.1 Denial of Service via inflateAsync Unhandled Error Event
CVE-2026-114105Medium· 6.2Adm-zip before 0.6.1 Privilege Escalation via keepOriginalPermission Setuid Bits
CVE-2026-102282High· 7.1adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js