CVE-2026-77301: adm-zip uncontrolled memory allocation via uncompressed size

CVE-2026-77301 · Severity: high · CVSS 7.5 · Published 2026-09-18

adm-zip is a Node.js library for reading and manipulating ZIP files. The library allocates memory based on the declared uncompressed file size in a ZIP archive before validating that size. An attacker can create a tiny malicious ZIP file (as small as 105 bytes) that declares an enormous uncompressed size, causing the application to allocate gigabytes of memory and crash, effectively denying service to all users of that application.

Technologies: adm-zip (npm). Vendors: npm.

Quick answers

Is CVE-2026-77301 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-77301 being exploited in the wild.
How severe is CVE-2026-77301?
High severity, with a CVSS score of 7.5, published 18 September 2026.
Which products and versions are affected?
adm-zip (npm) < 0.6.1, SEMVER:introduced=0,fixed=0.6.1.
Is there a fix for CVE-2026-77301?
Yes. adm-zip (npm): upgrade to 0.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77301 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-77301?
Check whether you run adm-zip (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • adm-zip (npm): upgrade to 0.6.1 or later
    npm install adm-zip@0.6.1

Technical details

The vulnerability is an uncontrolled memory allocation (denial of service) in the zipEntry.js component. When `getData()` is called on a ZIP entry, the library allocates a buffer using `Buffer.alloc(&lt;declared uncompressed size&gt;)` before performing validation of the declared size against compressed size or available data. An attacker can craft a ZIP with a stored (uncompressed) entry that declares an unreasonably large uncompressed size while providing only a few bytes of actual data. This forces the application to commit gigabytes of memory before the CRC32 validation fails, causing out-of-memory kills on resource-constrained hosts (containers, serverless functions) that cannot be caught by application error handlers. No authentication is required; the attack vector is network-accessible to any service processing untrusted ZIP files.

Affected products

  • adm-zip adm-zip 0.5.17 and earlier

Identifiers

  • CVE-2026-77301
  • GHSA-7q85-xj36-vmfc

Timeline

  • 2026-09-18: disclosed
  • other: CVE-2026-77301 assigned

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.