CVE-2026-114102 Details

A denial-of-service vulnerability has been identified in the adm-zip library, affecting versions prior to 0.6.1. The issue arises in the async DEFLATE decompression method, inflateAsync, located in methods/inflater.js. This vulnerability allows unauthenticated attackers to crash the Node.js process by uploading a malformed ZIP file. The problem occurs because the inflateAsync method does not include an error listener for the zlib stream, leaving the Node.js process vulnerable to an uncatchable exception that disrupts all ongoing requests. The vulnerability can be exploited by supplying a ZIP file with corrupted DEFLATE data, which is processed by any of adm-zip's asynchronous APIs, such as readFileAsync, readAsTextAsync, extractAllToAsync, or ZipEntry.getDataAsync.

To address this vulnerability, an error listener should be added to the InflateRaw stream in the inflateAsync method. This listener should handle errors by passing them to the existing callback function, following the asynchronous error-handling conventions used throughout the rest of the codebase.