p PatchFirst

CVE-2026-114104

CVE-2026-114104 · adm-zip before 0.6.1 Duplicate ZIP Entry Name Validation Bypass

This page contains facts from public vulnerability sources. Check the original advisory before updating.

adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content validation by supplying ZIP archives with duplicate entry names. Attackers can craft archives where getEntry() returns the last duplicate while extractAllTo() writes the first, causing unvalidated bytes to be written to disk.

CVSS 8.2 · High · EPSS 0.2% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • adm-zip

    Versions
    • ≥ 0, < 0.6.1: Affected (semver)
    • 0.6.1: Not affected (semver)

    Update to 0.6.1

  • adm-zip npm

    Affected ranges
    • SEMVER: < 0.6.1

    Update to 0.6.1

Original sources

Check your server →