Priority HIGH 77
adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.js process via a malformed ZIP file, because inflateAsync in methods/inflater.js lacks a zlib stream…
cthackers
Records9All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high5CVSS 7.0–8.9
Exploited now
cthackers records in CISA KEVNo cthackers vulnerabilities are listed in CISA KEV.
Records
9 records
TI-2026-53963 CVE-2026-77301 · GHSA-7q85-xj36-vmfc
adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)
Priority HIGH 72
adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js.
Priority HIGH 70
adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the maxOutputLength guard by targeting the asynchronous getDataAsync() path in methods/inflater.js.
Priority HIGH 69
adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content validation by supplying ZIP archives with duplicate entry names.
Priority HIGH 66
adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js.
TI-2026-62130 CVE-2026-92000 · GHSA-ffxc-vw9f-x2cp
adm-zip 0.5.14 through 0.6.0 Denial of Service via Zero Declared Uncompressed Size
Priority MEDIUM 45
adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP entries declare zero uncompressed size.
Priority LOW 29
Adm-zip before 0.6.1 contains an incorrect permission assignment vulnerability that allows attackers to set setuid, setgid, or sticky bits on extracted files when keepOriginalPermission is enabled.
TI-2026-53681 CVE-2026-76845 · GHSA-vwc7-r8mq-g2x9
adm-zip 0.5.9 through 0.6.0 Arbitrary File Overwrite via Symlink Following on Extraction
Priority LOW 29
adm-zip 0.5.9 through 0.6.0 follows symbolic links at the extraction destination.
TI-2026-80156 CVE-2026-116137 · GHSA-mv5w-h6hm-qcp7
adm-zip validation bypass via canonically equivalent ZIP entry names
Priority LOW 28
adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries() check by using canonically equivalent entry names like './hello.txt' and 'hello.txt'.