CVE-2026-77301
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
A vulnerability in the adm-zip library (JavaScript) prior to 0.6.1 affects getData() in zipEntry.js, which trusts an entry's central-directory uncompressed size and allocates output memory before validating that value against the actual compressed data. A small crafted ZIP can declare a multi-gigabyte uncompressed size, causing excessive memory consumption before CRC validation reports an error. Applications reading entries from untrusted archives can be terminated by the OS or suffer memory exhaustion.
Risk Assessment
An attacker can cause a denial of service by exhausting memory, leading to application or system crashes.
Recommendation
Update adm-zip to version 0.6.1 or later. Additionally, validate file sizes before processing archives.
Other vulnerabilities in adm-zip
See all- CVE-2026-92000High
adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP entries declare zero uncompressed size. Attackers can craft malicious ZIP archives with highly compressible entries declaring zero size to exhaust memory and cause denial of service.
- CVE-2026-76845Medium
adm-zip 0.5.9 through 0.6.0 follows symbolic links at the extraction destination. Utils.sanitize enforces containment by comparing only the string form of an archive entry name against the resolved extraction root, and Utils.writeFileTo opens the computed destination with fs.openSync(path, "w", 0o666), which resolves symbolic links and carries neither O_NOFOLLOW nor a pre-write fs.lstatSync check. When a path component at the destination already exists as a symbolic link pointing outside the extraction root, extractAllTo, extractAllToAsync and extractEntryTo write the entry contents through that link and then chmod its target, placing attacker-controlled content in a file outside the root without any traversal sequence appearing in the archive. Reaching the write requires overwrite to be enabled, because the preceding fs.existsSync check also resolves the link and otherwise declines.
- CVE-2026-39244High
The adm-zip library before version 0.5.18 is vulnerable to denial of service via a crafted ZIP file with a manipulated uncompressed size header field. An attacker can create a small ZIP file (about 120 bytes) declaring an uncompressed size of 4 GB, leading to memory allocation amplification of over 33 million to 1, causing a process crash.
Original NVD description (English source)
adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, getData() in zipEntry.js trusts an entry's central-directory uncompressed size and allocates output memory before validating that value against the actual compressed data and decompression result. A small crafted ZIP can declare a multi-gigabyte uncompressed size, causing Buffer.alloc and decompression handling to commit excessive resident memory before CRC validation reports an error. Applications that read entries from untrusted archives can therefore be terminated by the operating system or suffer service-wide memory exhaustion. This issue is fixed in version 0.6.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS