adm-zip vulnerabilities

CVEs whose affected-version data names the adm-zip package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

3 CVEsRSS

CVE-2026-77301High· 7.5PoC

4d ago

adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js

adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, getData() in zipEntry.js trusts an entry's central-directory uncompressed size and allocates output memory before validating that value …

▾ Midnightadm-zip · adm-zipEPSS 0.41%via NVD

CVE-2026-92000High· 7.5

1w ago

adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP entries declare zero uncompressed size

adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP entries declare zero uncompressed size. Attackers can craft malicious ZIP archives with highly compressible entries declaring zero size to exha…

▾ Twilightcthackers · adm-zipEPSS 0.39%via NVD

CVE-2026-76845Medium· 6.5

4w ago

adm-zip extraction follows destination symlinks, allowing arbitrary file overwrite

▾ Sunlitadm-zip · adm-zipEPSS 0.13%via GHSA