CVE-2026-114103

The adm-zip library version 0.6.0 is vulnerable to a decompression bomb protection bypass within the methods/inflater.js file. Specifically, the getDataAsync() path fails to properly enforce the maxOutputLength guard. Attackers can exploit this by crafting malicious ZIP entries with falsified sma...