Live › vulnerability › CVE-2026-114102
Go to dashboardadm-zip before 0.6.1 does not handle zlib stream errors in its async inflater, so a ZIP with corrupted DEFLATE data throws an uncatchable exception. An unauthenticated attacker who can get such a file processed can crash the whole Node.js process and drop all in-flight requests.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Run npm ls adm-zip in each project and check whether the resolved version is below 0.6.1.
Look for code calling readFileAsync, readAsTextAsync, extractAllToAsync or getDataAsync on untrusted uploads.
0.6.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.js process via a malformed ZIP file, because inflateAsync in methods/inflater.js lacks a zlib stream error listener. Attackers can supply a ZIP with corrupted DEFLATE data processed by readFileAsync, readAsTextAsync, extractAllToAsync, or getDataAsync, triggering an uncatchable exception that terminates all in-flight requests.
This page as .md · .json · in your agent: get_signal("CVE-2026-114102")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.