SUSE CVE-2026-92000

adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP entries declare zero uncompressed size. Attackers can craft malicious ZIP archives with highly compressible entries declaring zero size to exhaust memory and cause denial of service...

CVE-2026-77301

creationtimestamp| type| source ---|---|--- 2026-09-18 18:35:04+00:00| published-proof-of-concept| https://github.com/cthackers/adm-zip/security/advisories/GHSA-7q85-xj36-vmfc 2026-09-19 08:31:44+00:00| seen| https://gist.github.com/alon710/43058acd721510462931518910022d1c...

GHSA-7Q85-XJ36-VMFC adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)

Summary adm-zip allocates an entry's output buffer from the declared uncompressed size central-directory size field before validating it against the actual data. A tiny crafted ZIP that declares a huge uncompressed size forces a multi-gigabyte allocation from a few bytes. Impact On adm-zip 0.5.17...

NPM: adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)

NPM: adm-zip: Uncontrolled memory allocation via the declared uncompressed size DoS vulnerability discovered by ? in WordPress Npm adm-zip versions 0.6.1...

Memory Allocation with Excessive Size Value

Overview adm-zip is a JavaScript implementation for zip data compression for NodeJS. Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the async decompression path in methods/inflater.js, where the decompression size cap enforced by zlib's...

0g-aura (>=0.1.0, <=0.4.31), 0g-kit (>=1.0.0, <=1.0.9) +16431 more potentially affected by CVE-2026-77301 via adm-zip (>=0.1.4, <=0.6.0)

adm-zip NPM version =0.1.4, =0.1.0, =1.0.0, =0.1.0, =0.2.9, =3.0.0-rc.0, =1.125.0, =1.2.2, =1.0.0, =1.0.0, =1.0.1, =1.0.10 and more Source cves: CVE-2026-77301 Source advisory: SNYK:JS-ADMZIP-19963965...

adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)

Summary adm-zip allocates an entry's output buffer from the declared uncompressed size central-directory size field before validating it against the actual data. A tiny crafted ZIP that declares a huge uncompressed size forces a multi-gigabyte allocation from a few bytes. Impact On adm-zip 0.5.17...

0g-aura (>=0.1.0, <=0.4.31), 0g-kit (>=1.0.0, <=1.0.9) +16431 more potentially affected by CVE-2026-77301 via adm-zip (>=0.1.4, <=0.6.0)

adm-zip NPM version =0.1.4, =0.1.0, =1.0.0, =0.1.0, =0.2.9, =3.0.0-rc.0, =1.125.0, =1.2.2, =1.0.0, =1.0.0, =1.0.1, =1.0.10 and more Source cves: CVE-2026-77301 Source advisory: OSV:GHSA-7Q85-XJ36-VMFC...

CVE-2026-77301

adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, getData in zipEntry.js trusts an entry's central-directory uncompressed size and allocates output memory before validating that value against the actual compressed data and decompression result. A...

CVE-2026-77301 adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)

adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, getData in zipEntry.js trusts an entry's central-directory uncompressed size and allocates output memory before validating that value against the actual compressed data and decompression result. A...

EUVD-2026-83170

adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, getData in zipEntry.js trusts an entry's central-directory uncompressed size and allocates output memory before validating that value against the actual compressed data and decompression result. A...

CVE-2026-77301 adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)

adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, getData in zipEntry.js trusts an entry's central-directory uncompressed size and allocates output memory before validating that value against the actual compressed data and decompression result. A...

CVE-2026-77301 adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)

adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, getData in zipEntry.js trusts an entry's central-directory uncompressed size and allocates output memory before validating that value against the actual compressed data and decompression result. A...

CVE-2026-77301

adm-zip is a Node.js JavaScript library for creating and extracting ZIP archives. Prior to version 0.6.1 , the getData() function in zipEntry.js trusts an entry's central-directory uncompressed size and allocates output memory before validating that value against the actual compressed data and de...

CVE-2026-77301: Memory Allocation with Excessive Size Value

adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, getData in zipEntry.js trusts an entry's central-directory uncompressed size and allocates output memory before validating that value against the actual compressed data and decompression result. A...

PT-2026-95496

Name of the Vulnerable Software and Affected Versions adm-zip versions prior to 0.6.1 Description The getData function in zipEntry.js trusts the uncompressed size declared in a ZIP entry's central directory and allocates output memory using Buffer.alloc before validating this value against the...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview adm-zip is a JavaScript implementation for zip data compression for NodeJS. Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via the inflater process. An attacker can exhaust system memory and disrupt service availability ...

0g-aura (>=0.1.0, <=0.4.31), 0g-kit (>=1.0.0, <=1.0.9) +16431 more potentially affected by CVE-2026-92000 via adm-zip (>=0.1.4, <=0.6.0)

adm-zip NPM version =0.1.4, =0.1.0, =1.0.0, =0.1.0, =0.2.9, =3.0.0-rc.0, =1.125.0, =1.2.2, =1.0.0, =1.0.0, =1.0.1, =1.0.10 and more Source cves: CVE-2026-92000 Source advisory: SNYK:JS-ADMZIP-19846655...

CVE-2026-92000

A flaw was found in adm-zip. A remote attacker could exploit this vulnerability by crafting a malicious ZIP archive containing highly compressible entries that declare a zero uncompressed size. This oversight prevents the application of zlib decompression output limits, leading to excessive memor...

CVE-2026-92000

adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP entries declare zero uncompressed size. Attackers can craft malicious ZIP archives with highly compressible entries declaring zero size to exhaust memory and cause denial of service...