rootpwn

high · CVSS v3 7.5

CVE-2026-77301

The adm-zip JavaScript library prior to version 0.6.1 is vulnerable to a denial of service condition in the zipEntry.js module. The getData(

Overview

The adm-zip JavaScript library prior to version 0.6.1 is vulnerable to a denial of service condition in the zipEntry.js module. The getData() function trusts uncompressed file sizes declared in the central directory without prior validation against actual data. This flaw matters because processing untrusted ZIP archives can lead to immediate memory exhaustion and application termination.

Description

adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, getData() in zipEntry.js trusts an entry's central-directory uncompressed size and allocates output memory before validating that value against the actual compressed data and decompression result. A small crafted ZIP can declare a multi-gigabyte uncompressed size, causing Buffer.alloc and decompression handling to commit excessive resident memory before CRC validation reports an error. Applications that read entries from untrusted archives can therefore be terminated by the operating system or suffer service-wide memory exhaustion. This issue is fixed in version 0.6.1.

Impact

This vulnerability primarily impacts availability by allowing unauthenticated users to crash Node.js applications that process untrusted archives. Integrity and confidentiality are not directly compromised, but service-wide memory exhaustion can cause total downtime for dependent systems. Operators of backend services handling user-uploaded archives are directly affected.

Remediation

Upgrade the adm-zip library to version 0.6.1 or later to incorporate proper size validation checks before memory allocation. If immediate patching is not possible, implement strict input validation, file size limits, and resource quotas around archive processing workflows.

Risk context

The vulnerability carries a CVSS v3 score of 7.5 (High) due to the severe impact on application availability. Although EPSS data is not currently present, the ease of triggering memory exhaustion via crafted archives warrants prompt attention.

Affected products

  • adm-zip Node.js library < 0.6.1

Scores

Severity
high
CVSS v2
7.8
CVSS v3
7.5
CVSS v4
—
EPSS
—

nodejs denial-of-service memory-exhaustion zip-slip buffer-allocation supply-chain

← All CVEs

Related CVEs

high

CVE-2026-93455

django-page-cms through version 2.0.13 contains an authorization bypass vulnerability in its admin helper views. The flaw allows low-privilege staff accounts to read unpublished drafts, page listings, and stored media paths without proper permission validation. This matters because it exposes sensitive organizational content to internal users who should not have access.

View analysis

high

CVE-2026-52727

The lxc-ci project inadvertently included a static pacman local-signing private key within Arch Linux container and virtual machine images built prior to May 28, 2026. This allows a malicious or compromised package mirror to issue cryptographically trusted packages to clients. Consequently, attackers can achieve arbitrary code execution as root on affected systems.

View analysis

high

CVE-2026-46655

A local integer overflow vulnerability exists in the virtio-win Viosock driver for Windows guests running on QEMU and KVM. A low-privilege local user can supply specially crafted inputs via IOCTL_SELECT to cause kernel heap memory corruption. This issue matters because it enables local privilege escalation within the guest operating system.

View analysis

high

CVE-2026-55556

Rsyslog versions 8.2110.0 through 8.2604.0 contain a heap-based memory corruption vulnerability in the optional imhttp module. An unauthenticated remote attacker can trigger this flaw by sending an oversized HTTP Basic Authorization header to an affected endpoint. This causes incorrect buffer allocation and adjacent memory overwrite, resulting in a denial of service.

View analysis