Skip to content
CVE PROGRAM SOURCE RECORD6.9 Medium

CVE-2026-114103

adm-zip 0.6.0 Decompression Bomb Guard Bypass via getDataAsync()

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the maxOutputLength guard by targeting the asynchronous getDataAsync() path in methods/inflater.js. Attackers can craft ZIP entries with falsified small declared sizes and high-ratio DEFLATE payloads to exhaust memory in applications reading entries asynchronously.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

cthackers adm-zip

Default version status: unaffected

  • 0.6.0 to < 0.6.1affected
  • 0.6.1unaffected
pkg:npm/adm-zip

References