CVE-2026-114102: adm-zip before 0.6.1 Denial of Service via inflateAsync Unhandled Error Event
adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.js process via a malformed ZIP file, because inflateAsync in methods/inflater.js lacks a zlib stream error listener. Attackers can supply a ZIP with corrupted DEFLATE data processed by readFileAsync, readAsTextAsync, extractAllToAsync, or getDataAsync, triggering an uncatchable exception that terminates all in-flight requests.
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using npm/adm-zip versions before 0.6.1 are exposed when they process attacker-supplied ZIP files through readFileAsync, readAsTextAsync, extractAllToAsync, or getDataAsync. An attacker does not need authentication.
What does an attacker need to trigger the denial of service?
The attacker needs to provide a ZIP archive containing corrupted DEFLATE data that is processed by one of the affected asynchronous methods. Successful exploitation crashes the Node.js process and terminates in-flight requests.
What version addresses the issue?
The issue affects adm-zip versions before 0.6.1. Updating to version 0.6.1 or later addresses the affected version range.