CVE-2026-114103 Details
Description
adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the maxOutputLength guard by targeting the asynchronous getDataAsync() path in methods/inflater.js. Attackers can craft ZIP entries with falsified small declared sizes and high-ratio DEFLATE payloads to exhaust memory in applications reading entries asynchronously.
A vulnerability exists in adm-zip version 0.6.0, allowing attackers to bypass the library's decompression bomb protection. This is achieved by exploiting the asynchronous getDataAsync() method, which fails to enforce the maxOutputLength guard that is applied in the synchronous getData() method. Attackers can create ZIP entries with misleadingly small declared sizes and high-ratio DEFLATE payloads, leading to memory exhaustion in applications that process entries asynchronously.
Users can upgrade to adm-zip version 0.6.1 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 21, 2026CISA-ADP
Assessed Oct 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/cthackers/adm-zip/security/advisories/GHSA-c6fg-446q-cg94 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/cthackers/adm-zip/security/advisories/GHSA-c6fg-446q-cg94 | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/adm-zip-0.6.0-decompression-bomb-guard-bypass-via-getdataasync | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| adm-zip | 0.6.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 27, 2026 | CVE Modified | CISA-ADP |
| Oct 21, 2026 | New CVE Received | [email protected] |