Executive brief
adm-zip is a popular library used by applications to create and extract ZIP files. A vulnerability exists where a specially crafted, very small ZIP file can trick the library into trying to reserve a massive amount of computer memory (up to 4GB). This can cause the application to crash immediately, leading to a service outage.
Technical details
adm-zip before version 0.6.0 is vulnerable to a denial-of-service (DoS) attack via memory exhaustion (CWE-789). The root cause is located in zipEntry.js and entryHeader.js, where the library uses Buffer.alloc() based on the 'uncompressed size' field from the ZIP central directory header without validating it against the actual data or enforcing an upper bound. An attacker can provide a small (~120-byte) ZIP file that claims to be ~4GB, causing a massive memory allocation before any CRC validation occurs. This affects all major extraction and read methods, including readFile() and extractAllTo(). The issue is fixed in version 0.6.0.
Affected products
- cthackers adm-zip < 0.6.0
Timeline
- 2026-07-10: advisory
- 2026-07-10: disclosed
- 2026-07-17: patched: GitHub reviewed and confirmed patch version 0.6.0