CVE-2026-114103

adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the maxOutputLength guard by targeting the asynchronous getDataAsync path in methods/inflater.js. Attackers can craft ZIP entries with falsified small declared sizes and high-ratio DEFLATE payloads to...

CVE-2026-114103

adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the maxOutputLength guard by targeting the asynchronous getDataAsync path in methods/inflater.js. Attackers can craft ZIP entries with falsified small declared sizes and high-ratio DEFLATE payloads to...

CVE-2026-114103

The adm-zip library version 0.6.0 is vulnerable to a decompression bomb protection bypass within the methods/inflater.js file. Specifically, the getDataAsync() path fails to properly enforce the maxOutputLength guard. Attackers can exploit this by crafting malicious ZIP entries with falsified sma...

EUVD-2026-106906

adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the maxOutputLength guard by targeting the asynchronous getDataAsync path in methods/inflater.js. Attackers can craft ZIP entries with falsified small declared sizes and high-ratio DEFLATE payloads to...

CVE-2026-114103 adm-zip 0.6.0 Decompression Bomb Guard Bypass via getDataAsync()

adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the maxOutputLength guard by targeting the asynchronous getDataAsync path in methods/inflater.js. Attackers can craft ZIP entries with falsified small declared sizes and high-ratio DEFLATE payloads to...

PT-2026-120229

adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the maxOutputLength guard by targeting the asynchronous getDataAsync path in methods/inflater.js. Attackers can craft ZIP entries with falsified small declared sizes and high-ratio DEFLATE payloads to...

GHSA-C6FG-446Q-CG94 adm-zip: getDataAsync() bypasses the maxOutputLength size guard enforced by the synchronous getData() path

Summary adm-zip enforces a maxOutputLength guard against decompression bombs on its synchronous getData path, but the equivalent asynchronous getDataAsync path does not enforce it — it accumulates and returns the entire decompressed output regardless of the entry's declared size. An application...

NPM: adm-zip: getDataAsync() bypasses the maxOutputLength size guard enforced by the synchronous getData() path

NPM: adm-zip: getDataAsync bypasses the maxOutputLength size guard enforced by the synchronous getData path vulnerability discovered by ? in WordPress Npm adm-zip versions = 0.6.0...

adm-zip: getDataAsync() bypasses the maxOutputLength size guard enforced by the synchronous getData() path

Summary adm-zip enforces a maxOutputLength guard against decompression bombs on its synchronous getData path, but the equivalent asynchronous getDataAsync path does not enforce it — it accumulates and returns the entire decompressed output regardless of the entry's declared size. An application...