Quick answers
- Is CVE-2026-39244 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-39244 being exploited in the wild.
- How severe is CVE-2026-39244?
- High severity, with a CVSS score of 7.5, published 10 July 2026.
- Which products and versions are affected?
- adm-zip (npm) < 0.6.0, SEMVER:introduced=0,fixed=0.6.0.
- Is there a fix for CVE-2026-39244?
- Yes. adm-zip (npm): upgrade to 0.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-39244 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-39244?
- Check whether you run adm-zip (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- adm-zip (npm): upgrade to 0.6.0 or later
npm install adm-zip@0.6.0
Technical details
adm-zip before version 0.6.0 is vulnerable to a denial-of-service (DoS) attack via memory exhaustion (CWE-789). The root cause is located in zipEntry.js and entryHeader.js, where the library uses Buffer.alloc() based on the 'uncompressed size' field from the ZIP central directory header without validating it against the actual data or enforcing an upper bound. An attacker can provide a small (~120-byte) ZIP file that claims to be ~4GB, causing a massive memory allocation before any CRC validation occurs. This affects all major extraction and read methods, including readFile() and extractAllTo(). The issue is fixed in version 0.6.0.
Affected products
- cthackers adm-zip < 0.6.0
Identifiers
- CVE-2026-39244
- GHSA-xcpc-8h2w-3j85
Timeline
- 2026-07-10: advisory
- 2026-07-10: disclosed
- 2026-07-17: patched: GitHub reviewed and confirmed patch version 0.6.0