13 matches found
Adm-zip: GetDataAsync() Bypasses The MaxOutputLength Size Guard Enforced By The Synchronous GetData() Path
Summary adm-zip enforces a "maxOutputLength" guard against decompression bombs on its synchronous "getData" path, but the equivalent asynchronous "getDataAsync" path does not enforce it — it accumulates and returns the entire decompressed output regardless of the entry's declared size. An...
CVE-2026-114103
adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the maxOutputLength guard by targeting the asynchronous getDataAsync path in methods/inflater.js. Attackers can craft ZIP entries with falsified small declared sizes and high-ratio DEFLATE payloads to...
EUVD-2026-106906
adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the maxOutputLength guard by targeting the asynchronous getDataAsync path in methods/inflater.js. Attackers can craft ZIP entries with falsified small declared sizes and high-ratio DEFLATE payloads to...
CVE-2026-114103
adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the maxOutputLength guard by targeting the asynchronous getDataAsync path in methods/inflater.js. Attackers can craft ZIP entries with falsified small declared sizes and high-ratio DEFLATE payloads to...
CVE-2026-114103 adm-zip 0.6.0 Decompression Bomb Guard Bypass via getDataAsync()
adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the maxOutputLength guard by targeting the asynchronous getDataAsync path in methods/inflater.js. Attackers can craft ZIP entries with falsified small declared sizes and high-ratio DEFLATE payloads to...
CVE-2026-114103
The adm-zip library version 0.6.0 is vulnerable to a decompression bomb protection bypass within the methods/inflater.js file. Specifically, the getDataAsync() path fails to properly enforce the maxOutputLength guard. Attackers can exploit this by crafting malicious ZIP entries with falsified sma...
CVE-2026-114103 adm-zip 0.6.0 Decompression Bomb Guard Bypass via getDataAsync()
adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the maxOutputLength guard by targeting the asynchronous getDataAsync path in methods/inflater.js. Attackers can craft ZIP entries with falsified small declared sizes and high-ratio DEFLATE payloads to...
PT-2026-120229
adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the maxOutputLength guard by targeting the asynchronous getDataAsync path in methods/inflater.js. Attackers can craft ZIP entries with falsified small declared sizes and high-ratio DEFLATE payloads to...
The Brain ADM-ZIP for NodeJS: Resource management error vulnerability
The Brain ADM-ZIP for NodeJS version 0.6.0 has a resource management vulnerability. This vulnerability stems from bypassing compression bomb protection. Attackers can exploit the asynchronous getDataAsync method in methods/inflater.js to bypass the maxOutputLength protection and create ZIP entrie...
NPM: adm-zip: getDataAsync() bypasses the maxOutputLength size guard enforced by the synchronous getData() path
NPM: adm-zip: getDataAsync bypasses the maxOutputLength size guard enforced by the synchronous getData path vulnerability discovered by ? in WordPress Npm adm-zip versions = 0.6.0...
adm-zip: getDataAsync() bypasses the maxOutputLength size guard enforced by the synchronous getData() path
Summary adm-zip enforces a maxOutputLength guard against decompression bombs on its synchronous getData path, but the equivalent asynchronous getDataAsync path does not enforce it — it accumulates and returns the entire decompressed output regardless of the entry's declared size. An application...
GHSA-C6FG-446Q-CG94 adm-zip: getDataAsync() bypasses the maxOutputLength size guard enforced by the synchronous getData() path
Summary adm-zip enforces a maxOutputLength guard against decompression bombs on its synchronous getData path, but the equivalent asynchronous getDataAsync path does not enforce it — it accumulates and returns the entire decompressed output regardless of the entry's declared size. An application...
PT-2026-109356
Summary adm-zip enforces a maxOutputLength guard against decompression bombs on its synchronous getData path, but the equivalent asynchronous getDataAsync path does not enforce it — it accumulates and returns the entire decompressed output regardless of the entry's declared size. An application...