p PatchFirst

CVE-2026-114103

CVE-2026-114103 · adm-zip 0.6.0 Decompression Bomb Guard Bypass via getDataAsync()

This page contains facts from public vulnerability sources. Check the original advisory before updating.

adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the maxOutputLength guard by targeting the asynchronous getDataAsync() path in methods/inflater.js. Attackers can craft ZIP entries with falsified small declared sizes and high-ratio DEFLATE payloads to exhaust memory in applications reading entries asynchronously.

CVSS 6.9 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • adm-zip

    Versions
    • ≥ 0.6.0, < 0.6.1: Affected (semver)
    • 0.6.1: Not affected (semver)

    Update to 0.6.1

  • adm-zip npm

    Affected ranges
    • SEMVER: < 0.6.1

    Update to 0.6.1

Original sources

Check your server →