# adm-zip async decompression denial of service

Source: https://junglewise.ai/threats/adm-zip-unhandled-error-event-in-async-deflate-decompression-crashes-337da7e4  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-29. Updated: 2026-09-30  
License: CC BY 4.0 with a link back

Severity: high · CVSS 7.5 · Published 2026-09-29

The adm-zip library, used to read and extract ZIP files in Node.js applications, does not properly handle errors that occur during async decompression of ZIP entries. An attacker can supply a ZIP file with a corrupted compressed payload to crash the entire Node.js process, taking down the server and affecting all users—even those unrelated to the malicious request.

Technologies: [adm-zip (npm)](https://junglewise.ai/threats/technologies/adm-zip). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** High severity, with a CVSS score of 7.5, published 29 September 2026.

**Which products and versions are affected?** adm-zip (npm) <= 0.6.0; Rg-Adguard Adm-Zip 0.6.0 and likely earlier versions; patched in 0.6.1.

**Is there a fix for This vulnerability?** A patch was published on 2026-09-29: Version 0.6.1 released with error handler on inflateAsync stream Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run adm-zip (npm) or Rg-Adguard Adm-Zip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The inflateAsync function in methods/inflater.js creates a zlib.createInflateRaw stream but fails to register an 'error' event listener. When zlib emits an error (e.g., Z_DATA_ERROR from malformed DEFLATE bytes), Node.js rethrows it as an uncaught exception on a later event loop tick, outside any try/catch that wraps the calling code. This affects all public async APIs: readFileAsync, readAsTextAsync, extractAllToAsync, and ZipEntry.getDataAsync. A fix is available in version 0.6.1.

## Affected products

- rg-adguard adm-zip 0.6.0 and likely earlier versions; patched in 0.6.1

## Timeline

- 2026-09-29: disclosed
- 2026-09-29: patched: Version 0.6.1 released with error handler on inflateAsync stream

## Related threats

- [Adm-zip incorrect permission assignment with keepOriginalPermission](https://junglewise.ai/threats/cve-2026-114105-adm-zip-before-0-6-1-contains-an-incorrect-permission-assignment)
- [adm-zip permission bit extraction privilege escalation](https://junglewise.ai/threats/cve-2026-102282-adm-zip-extraction-preserves-suid-sgid-bits-from-untrusted-zips)
- [adm-zip duplicate ZIP entry name validation bypass](https://junglewise.ai/threats/adm-zip-duplicate-zip-entry-names-getentry-and-extractallto-resolve-to-42f08f8e)
- [adm-zip getDataAsync() decompression bomb bypass](https://junglewise.ai/threats/adm-zip-getdataasync-bypasses-the-maxoutputlength-size-guard-enforced-3e032cd1)
- [adm-zip uncontrolled memory allocation via uncompressed size](https://junglewise.ai/threats/cve-2026-77301-adm-zip-uncontrolled-memory-allocation-via-uncompressed-size)