Is CVE-2026-92000 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-92000 being exploited in the wild.

How severe is CVE-2026-92000?

High severity, with a CVSS score of 7.5, published 15 September 2026.

Which products and versions are affected?

adm-zip (npm) SEMVER:introduced=0,fixed=0.6.1.

Is there a fix for CVE-2026-92000?

Yes. adm-zip (npm): upgrade to 0.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-92000 attacked?

It is attacked over the network.

Am I affected by CVE-2026-92000?

Check whether you run adm-zip (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-92000: adm-zip decompression DoS via zero-size ZIP entries

CVE-2026-92000 · Severity: high · CVSS 7.5 · Published 2026-09-15

adm-zip is a popular JavaScript library for creating and extracting ZIP files in Node.js applications. Versions 0.5.14 through 0.6.0 contain a flaw that allows attackers to craft specially crafted ZIP archives with highly compressed entries that declare zero uncompressed size. When these malicious archives are processed, the application can exhaust server memory and crash, leading to denial of service and potential business disruption.

Technologies: adm-zip (npm). Vendors: npm.

Quick answers

Is CVE-2026-92000 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-92000 being exploited in the wild.
How severe is CVE-2026-92000?: High severity, with a CVSS score of 7.5, published 15 September 2026.
Which products and versions are affected?: adm-zip (npm) SEMVER:introduced=0,fixed=0.6.1.
Is there a fix for CVE-2026-92000?: Yes. adm-zip (npm): upgrade to 0.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-92000 attacked?: It is attacked over the network.
Am I affected by CVE-2026-92000?: Check whether you run adm-zip (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

adm-zip (npm): upgrade to 0.6.1 or later
```
npm install adm-zip@0.6.1
```

Technical details

The vulnerability is a denial-of-service flaw in adm-zip's zlib decompression handling. When ZIP entries declare zero uncompressed size, the library fails to apply proper output limits during decompression, allowing an attacker to craft highly compressible (zip-bomb-style) archives that decompress to enormous sizes in memory. The attack is network-accessible if the application processes untrusted ZIP files, and requires no authentication. An attacker can trigger out-of-memory conditions and crash the application. The vulnerability affects versions 0.5.14 through 0.6.0; patched versions beyond 0.6.0 are believed to be available.

Affected products

cthackers adm-zip 0.5.14 through 0.6.0

Identifiers

CVE-2026-92000
GHSA-rcw4-f5rp-g42v

Timeline

2026-09-15: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.