CVE-2026-114103: adm-zip 0.6.0 Decompression Bomb Guard Bypass via getDataAsync()
adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the maxOutputLength guard by targeting the asynchronous getDataAsync() path in methods/inflater.js. Attackers can craft ZIP entries with falsified small declared sizes and high-ratio DEFLATE payloads to exhaust memory in applications reading entries asynchronously.
Affected Software
Event History
Frequently Asked Questions
Which applications are realistically exposed?
Applications using npm/adm-zip 0.6.0 are exposed when they read attacker-controlled ZIP entries through the asynchronous getDataAsync() path. The impact is memory exhaustion from high-ratio DEFLATE payloads with falsely small declared sizes.
What does an attacker need to exploit this issue?
An attacker needs to supply a crafted ZIP archive or ZIP entry that the application processes asynchronously with getDataAsync(). No authentication or user interaction is required according to the provided vector.
Is the decompression bomb guard effective for asynchronous ZIP extraction?
No. In the affected asynchronous path, an attacker can evade the maxOutputLength guard by declaring a small entry size while supplying a DEFLATE payload that expands to a much larger amount of data.
What can be done if updating is not immediately possible?
Avoid processing untrusted ZIP entries through getDataAsync(), particularly where archives may contain DEFLATE-compressed data. Enforce external archive-size and resource limits to reduce the risk of memory exhaustion.