CVE-2026-39244: High severity npm/adm-zip vulnerability
adm-zip before 0.5.18 is vulnerable to denial of service via a crafted ZIP file with a manipulated uncompressed size header field. In zipEntry.js line 103, Buffer.alloc(centralHeader.size) allocates memory based on the declared uncompressed size from the ZIP central directory header without validating it against the actual compressed data size or imposing any upper bound. The size value is read directly from the binary header at entryHeader.js line 266 with no bounds check. An attacker can craft a ~120-byte ZIP file that declares ~4GB uncompressed size, causing a memory allocation amplification ratio of over 33 million to 1. The allocation occurs before CRC validation, so the malicious payload cannot be rejected early. All extraction and read methods are affected: readFile(), readAsText(), extractEntryTo(), extractAllTo(), extractAllToAsync(), test(), and entry.getData(). Any application accepting untrusted ZIP files via adm-zip is vulnerable to immediate process crash.
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to this denial of service?
Any application using an affected adm-zip version that accepts ZIP files from untrusted sources is exposed. The issue affects readFile(), readAsText(), extractEntryTo(), extractAllTo(), extractAllToAsync(), test(), and entry.getData().
Does exploitation require authentication, user interaction, or a valid archive payload?
No authentication or user interaction is required. An attacker only needs to supply a crafted ZIP whose central-directory uncompressed-size field is manipulated; allocation happens before CRC validation, so the archive cannot be rejected early based on CRC failure.
What is the operational impact of a successful exploit?
Processing the crafted ZIP can trigger an immediate process crash through excessive memory allocation. A roughly 120-byte ZIP can declare an uncompressed size of roughly 4 GB, creating a memory-allocation amplification ratio exceeding 33 million to 1.
What versions are affected?
adm-zip versions before 0.5.18 are affected.