ROOT-APP-NPM-CVE-2026-77301 CVE-2026-77301 in adm-zip - Patched by Root

Root has patched CVE-2026-77301 in the adm-zip package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-39244 CVE-2026-39244 in adm-zip - Patched by Root

Root has patched CVE-2026-39244 in the adm-zip package for Root:npm. Multiple fixed versions available...

CLSA-2026-1790718594 TuxCare security update for adm-zip (1 CVE)

TuxCare rebuilt adm-zip to address 1 CVE. Fixed in 0.5.18-tuxcare.4...

adm-zip: Decompression-bomb protection (fix for CVE-2026-39244) can be bypassed by declaring uncompressed size as 0

Affected package: adm-zip npm Affected version: 0.6.0 Summary The fix shipped for CVE-2026-39244 methods/inflater.js caps zlib's decompression output via maxOutputLength: expectedLength, where expectedLength is read directly from the ZIP entry's attacker-controlled "uncompressed size" header fiel...

NPM: adm-zip: Decompression-bomb protection (fix for CVE-2026-39244) can be bypassed by declaring uncompressed size as 0

NPM: adm-zip: Decompression-bomb protection fix for CVE-2026-39244 can be bypassed by declaring uncompressed size as 0 vulnerability discovered by ? in WordPress Npm adm-zip versions = 0.6.0...

NPM: adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation

NPM: adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs - local privilege escalation vulnerability discovered by ? in WordPress Npm adm-zip versions = 0.6.0...

adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation

Summary adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via fs.chmodSync when keepOriginalPermission=true is passed to extractAllTo/extractEntryTo — and it never filters the setuid/setgid/sticky bits out of those bits. A zip crafted by an attacker can...

CLSA-2026-1790176614 TuxCare security update for adm-zip (1 CVE)

TuxCare rebuilt adm-zip to address 1 CVE. Fixed in 0.5.10-tuxcare.1...

CLSA-2026-1790165044 TuxCare security update for adm-zip (1 CVE)

TuxCare rebuilt adm-zip to address 1 CVE. Fixed in 0.5.12-tuxcare.1...

CLSA-2026-1790162696 TuxCare security update for adm-zip (1 CVE)

TuxCare rebuilt adm-zip to address 1 CVE. Fixed in 0.5.16-tuxcare.1...

CLSA-2026-1790161376 TuxCare security update for adm-zip (1 CVE)

TuxCare rebuilt adm-zip to address 1 CVE. Fixed in 0.5.17-tuxcare.1...

Linux Distros Unpatched Vulnerability : CVE-2026-77301

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, getData in zipEntry.js trusts an entry's central-directory...

CVE-2026-77301

A flaw was found in adm-zip, a JavaScript library for handling ZIP archives. The getData function in zipEntry.js allocates memory based on the declared uncompressed size in a ZIP entry's central directory without validating this value against the actual compressed data. A remote attacker can...

CVE-2026-77301

creationtimestamp| type| source ---|---|--- 2026-09-18 18:35:04+00:00| published-proof-of-concept| https://github.com/cthackers/adm-zip/security/advisories/GHSA-7q85-xj36-vmfc 2026-09-19 08:31:44+00:00| seen| https://gist.github.com/alon710/43058acd721510462931518910022d1c...

NPM: adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)

NPM: adm-zip: Uncontrolled memory allocation via the declared uncompressed size DoS vulnerability discovered by ? in WordPress Npm adm-zip versions 0.6.1...

GHSA-7Q85-XJ36-VMFC adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)

Summary adm-zip allocates an entry's output buffer from the declared uncompressed size central-directory size field before validating it against the actual data. A tiny crafted ZIP that declares a huge uncompressed size forces a multi-gigabyte allocation from a few bytes. Impact On adm-zip 0.5.17...

adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)

Summary adm-zip allocates an entry's output buffer from the declared uncompressed size central-directory size field before validating it against the actual data. A tiny crafted ZIP that declares a huge uncompressed size forces a multi-gigabyte allocation from a few bytes. Impact On adm-zip 0.5.17...

Memory Allocation with Excessive Size Value

Overview adm-zip is a JavaScript implementation for zip data compression for NodeJS. Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the async decompression path in methods/inflater.js, where the decompression size cap enforced by zlib's...

CVE-2026-77301

adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, getData in zipEntry.js trusts an entry's central-directory uncompressed size and allocates output memory before validating that value against the actual compressed data and decompression result. A...

CVE-2026-77301

adm-zip is a Node.js JavaScript library for creating and extracting ZIP archives. Prior to version 0.6.1 , the getData() function in zipEntry.js trusts an entry's central-directory uncompressed size and allocates output memory before validating that value against the actual compressed data and de...