# CVE-2026-42886: advplyr Audiobookshelf DoS via memory exhaustion in backup upload

Source: https://junglewise.ai/threats/cve-2026-42886-advplyr-audiobookshelf-dos-via-memory-exhaustion-in-backup-upload  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-11. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-42886 · Severity: medium · CVSS 4.9 · Published 2026-05-11

Audiobookshelf is a self-hosted server for managing audiobooks and podcasts. A vulnerability in the backup upload feature allows an administrator to crash the server by uploading a specially crafted backup file. This occurs because the server attempts to decompress the file's contents entirely into its system memory without checking the size first, leading to a complete service outage.

Technologies: [Advplyr Audiobookshelf](https://junglewise.ai/threats/technologies/audiobookshelf). Vendors: [Advplyr](https://junglewise.ai/threats/vendors/advplyr).

## Quick answers

**Is CVE-2026-42886 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42886 being exploited in the wild.

**How severe is CVE-2026-42886?** Medium severity, with a CVSS score of 4.9, published 11 May 2026.

**Which products and versions are affected?** Advplyr Audiobookshelf < 2.32.2.

**Is there a fix for CVE-2026-42886?** A patch was published on 2026-05-11: Fix confirmed in version 2.32.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42886 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-42886?** Check whether you run Advplyr Audiobookshelf at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A memory amplification vulnerability exists in the `POST /api/backups/upload` endpoint of Audiobookshelf. The `uploadBackup` handler in `BackupManager.js` utilizes `zip.entryData()` to decompress the 'details' entry of an uploaded `.audiobookshelf` ZIP file directly into a Buffer without size limits. Furthermore, the `fileUpload()` middleware in `Server.js` lacks a `fileSize` limit, allowing arbitrarily large files to be processed. An attacker with administrative privileges can upload a ZIP file containing highly compressed data (a 'zip bomb' variant) that expands to gigabytes in memory, leading to an Out-of-Memory (OOM) crash of the Node.js process. This issue is fixed in version 2.32.2.

## Affected products

- advplyr Audiobookshelf < 2.32.2

## Timeline

- 2026-04-28: advisory: GitHub Security Advisory published
- 2026-05-11: disclosed: NVD publication date
- 2026-05-11: patched: Fix confirmed in version 2.32.2

## References

- [https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-4jq4-rvq8-j26h](https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-4jq4-rvq8-j26h)

## Related threats

- [advplyr Audiobookshelf path traversal in PodcastController](https://junglewise.ai/threats/cve-2026-42888-advplyr-audiobookshelf-path-traversal-in-podcastcontroller)
- [advplyr Audiobookshelf stored XSS in Login Page](https://junglewise.ai/threats/cve-2026-42887-advplyr-audiobookshelf-stored-xss-in-login-page)
- [Audiobookshelf path traversal in filesystem existence check](https://junglewise.ai/threats/cve-2026-42885-audiobookshelf-path-traversal-in-filesystem-existence-check)
- [advplyr Audiobookshelf incorrect authorization in collection endpoints](https://junglewise.ai/threats/cve-2026-42884-advplyr-audiobookshelf-incorrect-authorization-in-collection)
- [advplyr Audiobookshelf incorrect authorization in bulk download endpoint](https://junglewise.ai/threats/cve-2026-42883-advplyr-audiobookshelf-incorrect-authorization-in-bulk-download)