All vulnerabilities
CVE-2026-114103GHSA-c6fg-446q-cg94

adm-zip 0.6.0 Decompression Bomb Guard Bypass via getDataAsync()

cthackers adm-zipnpmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
6.9Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.27%Chance of exploitation activity in the next 30 days, higher than 18% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in0.6.1Fixed versionCVE List
Published21 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

  • 0.6.1adm-zipCVE List
  • 0.6.1adm-zip, npmOSVnpm install adm-zip@0.6.1

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the maxOutputLength guard by targeting the asynchronous getDataAsync() path in methods/inflater.js. Attackers can craft ZIP entries with falsified small declared sizes and high-ratio DEFLATE payloads to exhaust memory in applications reading entries asynchronously.

Text from CVE List

Affected versions 3

  • adm-zipaffected: 0.6.0 before 0.6.1CVE List
  • adm-zipunaffected: 0.6.1CVE List
  • adm-zip, npmfrom first release, fixed in 0.6.1OSV

References 2