adm-zip: Denial of service via unhandled zlib error in async decompression
Summary
adm-zip, a pure JavaScript ZIP library for Node.js, crashes the entire Node.js process before version 0.6.1 when its async decompression API processes a ZIP file with corrupted DEFLATE data. An unauthenticated attacker can trigger this with a single small malformed file uploaded to any service that calls readFileAsync, readAsTextAsync, extractAllToAsync or getDataAsync. The crash terminates all in-flight requests of that process, while confidentiality and integrity are not affected.
Affected
- adm-zip versions before 0.6.1 (exact older affected versions unknown; treat all earlier versions as vulnerable)
- Affected code path: inflateAsync in methods/inflater.js
Fixed in
- Upgrade to adm-zip 0.6.1 or later (fix included in 0.6.1)
Workaround
- No vendor workaround known.
- Interim measures: stop accepting ZIP uploads on affected endpoints, run ZIP extraction in an isolated worker or child process, and rate-limit upload endpoints.
Exploitation
- No confirmed exploitation in the wild found; no CISA KEV entry found.
- CISA SSVC: exploitation status 'poc' (proof of concept), automatable: yes, technical impact: partial.
- EPSS: 0.00455.
- Public PoC repositories are referenced, but their content was not verified.
Our recommendation
- Upgrade adm-zip to 0.6.1 or later wherever it processes ZIP files, including transitive dependencies in lock files.
- Prioritise Node.js services that accept ZIP uploads from untrusted users.
- Check whether internet-facing services accept ZIP files and isolate extraction in a separate process.
- Monitor for unexpected Node.js process crashes and restarts.
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (1 repositories)
anywaye/nilepatch-admzip-dos
Research sources
- GitHub Security Advisory GHSA-8238-w5pm-2374 github.com
- VulnCheck advisory www.vulncheck.com
- OSV record CVE-2026-114102 osv.dev
- OSV record GHSA-8238-w5pm-2374 osv.dev
- adm-zip releases github.com
- adm-zip on npm www.npmjs.com
- Tenable CVE-2026-114102 www.tenable.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 01:08.
Original description (NVD)
adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.js process via a malformed ZIP file, because inflateAsync in methods/inflater.js lacks a zlib stream error listener. Attackers can supply a ZIP with corrupted DEFLATE data processed by readFileAsync, readAsTextAsync, extractAllToAsync, or getDataAsync, triggering an uncatchable exception that terminates all in-flight requests.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.