Executive brief
Audiobookshelf is a self-hosted server for managing audiobooks and podcasts. A vulnerability in the backup upload feature allows an administrator to crash the server by uploading a specially crafted backup file. This occurs because the server attempts to decompress the file's contents entirely into its system memory without checking the size first, leading to a complete service outage.
Technical details
A memory amplification vulnerability exists in the `POST /api/backups/upload` endpoint of Audiobookshelf. The `uploadBackup` handler in `BackupManager.js` utilizes `zip.entryData()` to decompress the 'details' entry of an uploaded `.audiobookshelf` ZIP file directly into a Buffer without size limits. Furthermore, the `fileUpload()` middleware in `Server.js` lacks a `fileSize` limit, allowing arbitrarily large files to be processed. An attacker with administrative privileges can upload a ZIP file containing highly compressed data (a 'zip bomb' variant) that expands to gigabytes in memory, leading to an Out-of-Memory (OOM) crash of the Node.js process. This issue is fixed in version 2.32.2.
Affected products
- advplyr Audiobookshelf < 2.32.2
Timeline
- 2026-04-28: advisory: GitHub Security Advisory published
- 2026-05-11: disclosed: NVD publication date
- 2026-05-11: patched: Fix confirmed in version 2.32.2