CVE-2026-114102

The adm-zip library (versions before 0.6.1 ) is vulnerable to a Denial of Service (DoS) attack. The root cause is located in methods/inflater.js, where the inflateAsync function lacks a zlib stream error listener . An unauthenticated attacker can provide a malformed ZIP file containing corrupted ...

Uncaught Exception

Overview adm-zip is a JavaScript implementation for zip data compression for NodeJS. Affected versions of this package are vulnerable to Uncaught Exception via inflateAsync in methods/inflater.js when processing a ZIP entry containing malformed DEFLATE data. The zlib.createInflateRaw stream emits...

GHSA-8238-W5PM-2374 adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)

Summary Denial of Service in adm-zip's async decompression API allows an unauthenticated attacker to crash the entire Node.js host process by supplying a single malformed ZIP file. Details Affected package: adm-zip Affected versions: at least 0.6.0 current latest; likely all versions containing t...

adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)

Summary Denial of Service in adm-zip's async decompression API allows an unauthenticated attacker to crash the entire Node.js host process by supplying a single malformed ZIP file. Details Affected package: adm-zip Affected versions: at least 0.6.0 current latest; likely all versions containing t...