Junglewise Threat Intelligence

CVE-2026-42886: advplyr Audiobookshelf DoS via memory exhaustion in backup upload

CVE-2026-42886 · Severity: medium · CVSS 4.9 · Published 2026-05-11

Technologies: Advplyr Audiobookshelf. Vendors: Advplyr.

Executive brief

Audiobookshelf is a self-hosted server for managing audiobooks and podcasts. A vulnerability in the backup upload feature allows an administrator to crash the server by uploading a specially crafted backup file. This occurs because the server attempts to decompress the file's contents entirely into its system memory without checking the size first, leading to a complete service outage.

Technical details

A memory amplification vulnerability exists in the `POST /api/backups/upload` endpoint of Audiobookshelf. The `uploadBackup` handler in `BackupManager.js` utilizes `zip.entryData()` to decompress the 'details' entry of an uploaded `.audiobookshelf` ZIP file directly into a Buffer without size limits. Furthermore, the `fileUpload()` middleware in `Server.js` lacks a `fileSize` limit, allowing arbitrarily large files to be processed. An attacker with administrative privileges can upload a ZIP file containing highly compressed data (a 'zip bomb' variant) that expands to gigabytes in memory, leading to an Out-of-Memory (OOM) crash of the Node.js process. This issue is fixed in version 2.32.2.

Affected products

  • advplyr Audiobookshelf < 2.32.2

Timeline

  • 2026-04-28: advisory: GitHub Security Advisory published
  • 2026-05-11: disclosed: NVD publication date
  • 2026-05-11: patched: Fix confirmed in version 2.32.2

References

Related threats