MEDIUM 6.9 NVD
CVE-2026-114103
adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the maxOutputLength guard by targeting the asynchronous getDataAsyn
adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the maxOutputLength guard by targeting the asynchronous getDataAsync() path in methods/inflater.js. Attackers can craft ZIP entries with falsified small declared sizes and high-ratio DEFLATE payloads to exhaust memory in applications reading entries asynchronously.
References
- https://github.com/cthackers/adm-zip/security/advisories/GHSA-c6fg-446q-cg94
- https://www.vulncheck.com/advisories/adm-zip-0.6.0-decompression-bomb-guard-bypass-via-get
This medium severity vulnerability with a CVSS score of 6.9 was published on 2026-10-21 via NVD.
vulnfeed aggregates 18180 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.