Executive brief
adm-zip is a Node.js library for reading and manipulating ZIP files. The library allocates memory based on the declared uncompressed file size in a ZIP archive before validating that size. An attacker can create a tiny malicious ZIP file (as small as 105 bytes) that declares an enormous uncompressed size, causing the application to allocate gigabytes of memory and crash, effectively denying service to all users of that application.
Technical details
The vulnerability is an uncontrolled memory allocation (denial of service) in the zipEntry.js component. When `getData()` is called on a ZIP entry, the library allocates a buffer using `Buffer.alloc(<declared uncompressed size>)` before performing validation of the declared size against compressed size or available data. An attacker can craft a ZIP with a stored (uncompressed) entry that declares an unreasonably large uncompressed size while providing only a few bytes of actual data. This forces the application to commit gigabytes of memory before the CRC32 validation fails, causing out-of-memory kills on resource-constrained hosts (containers, serverless functions) that cannot be caught by application error handlers. No authentication is required; the attack vector is network-accessible to any service processing untrusted ZIP files.
Affected products
- adm-zip adm-zip 0.5.17 and earlier
Timeline
- 2026-09-18: disclosed
- other: CVE-2026-77301 assigned