NPM: adm-zip: Decompression-bomb protection (fix for CVE-2026-39244) can be bypassed by declaring uncompressed size as 0

🗓️ 29 Sep 2026 18:25:20Reported by PatchstackType

patchstack🔗 patchstack.com👁 2 Views

Decompression-bomb protection bypass in adm-zip by declaring uncompressed size as 0.

Reporter	Title	Published	Views	Family All 97
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses adm-zip-0.5.16.tgz which is vulnerable to CVE-2026-39244.	27 Aug 202619:22	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to Node.js modules adm-zip and websocket-driver (CVE-2026-39244, CVE-2026-54466 and CVE-2026-54490)	7 Sep 202606:57	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities affect IBM Decision Optimization for Cloud Pak for Data.	3 Sep 202616:23	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Data Product Hub	7 Aug 202616:35	–	ibm
Chainguard	CVE-2026-39244 vulnerabilities	21 Jul 202614:17	–	cgr
Circl	CVE-2026-39244	10 Jul 202622:43	–	circl
CVE	CVE-2026-39244	10 Jul 202600:00	–	cve
Cvelist	CVE-2026-39244	10 Jul 202600:00	–	cvelist
EUVD	EUVD-2026-42960	10 Jul 202618:32	–	euvd
Github Security Blog	adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)	29 Sep 202623:10	–	github

Vulners

Node

npm adm-zipRange≤0.6.0

Source	Link
github	www.github.com/cthackers/adm-zip/security/advisories/GHSA-rcw4-f5rp-g42v
github	www.github.com/cthackers/adm-zip/commit/491600683dacb6cb9fe0718a0eeb9cb5eb49afa6
github	www.github.com/cthackers/adm-zip/releases/tag/v0.6.1
github	www.github.com/advisories/GHSA-rcw4-f5rp-g42v

29 Sep 2026 18:25Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.17.5

EPSS0.00841

SSVC

adm-zip Decompression-bomb protection uncompressed size bypass