# CVE-2026-39244: cthackers adm-zip denial of service via manipulated uncompressed size header

Source: https://junglewise.ai/threats/cve-2026-39244-cthackers-adm-zip-denial-of-service-via-manipulated-uncompressed  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-10. Updated: 2026-07-17  
License: CC BY 4.0 with a link back

CVE-2026-39244 · Severity: high · CVSS 7.5 · Published 2026-07-10

adm-zip is a popular library used by applications to create and extract ZIP files. A vulnerability exists where a specially crafted, very small ZIP file can trick the library into trying to reserve a massive amount of computer memory (up to 4GB). This can cause the application to crash immediately, leading to a service outage.

Technologies: [adm-zip (npm)](https://junglewise.ai/threats/technologies/adm-zip). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-39244 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-39244 being exploited in the wild.

**How severe is CVE-2026-39244?** High severity, with a CVSS score of 7.5, published 10 July 2026.

**Which products and versions are affected?** adm-zip (npm) < 0.6.0, SEMVER:introduced=0,fixed=0.6.0.

**Is there a fix for CVE-2026-39244?** Yes. adm-zip (npm): upgrade to 0.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-39244 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-39244?** Check whether you run adm-zip (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- adm-zip (npm): upgrade to 0.6.0 or later

  ```sh
  npm install adm-zip@0.6.0
  ```


## Technical details

adm-zip before version 0.6.0 is vulnerable to a denial-of-service (DoS) attack via memory exhaustion (CWE-789). The root cause is located in zipEntry.js and entryHeader.js, where the library uses Buffer.alloc() based on the 'uncompressed size' field from the ZIP central directory header without validating it against the actual data or enforcing an upper bound. An attacker can provide a small (~120-byte) ZIP file that claims to be ~4GB, causing a massive memory allocation before any CRC validation occurs. This affects all major extraction and read methods, including readFile() and extractAllTo(). The issue is fixed in version 0.6.0.

## Affected products

- cthackers adm-zip < 0.6.0

## Identifiers

- CVE-2026-39244
- GHSA-xcpc-8h2w-3j85

## Timeline

- 2026-07-10: advisory
- 2026-07-10: disclosed
- 2026-07-17: patched: GitHub reviewed and confirmed patch version 0.6.0

## References

- [https://api.github.com/users/julianladisch](https://api.github.com/users/julianladisch)
- [https://github.com/julianladisch](https://github.com/julianladisch)
- [https://api.github.com/users/julianladisch/gists%7B/gist_id%7D](https://api.github.com/users/julianladisch/gists%7B/gist_id%7D)
- [https://api.github.com/users/julianladisch/repos](https://api.github.com/users/julianladisch/repos)
- [https://avatars.githubusercontent.com/u/533612?v=4](https://avatars.githubusercontent.com/u/533612?v=4)
- [https://api.github.com/users/julianladisch/events%7B/privacy%7D](https://api.github.com/users/julianladisch/events%7B/privacy%7D)

## Related threats

- [Adm-zip incorrect permission assignment with keepOriginalPermission](https://junglewise.ai/threats/cve-2026-114105-adm-zip-before-0-6-1-contains-an-incorrect-permission-assignment)
- [adm-zip permission bit extraction privilege escalation](https://junglewise.ai/threats/cve-2026-102282-adm-zip-extraction-preserves-suid-sgid-bits-from-untrusted-zips)
- [adm-zip duplicate ZIP entry name validation bypass](https://junglewise.ai/threats/adm-zip-duplicate-zip-entry-names-getentry-and-extractallto-resolve-to-42f08f8e)
- [adm-zip getDataAsync() decompression bomb bypass](https://junglewise.ai/threats/adm-zip-getdataasync-bypasses-the-maxoutputlength-size-guard-enforced-3e032cd1)
- [adm-zip async decompression denial of service](https://junglewise.ai/threats/adm-zip-unhandled-error-event-in-async-deflate-decompression-crashes-337da7e4)