Live › vulnerability › CVE-2026-114103
Go to dashboardadm-zip 0.6.0 fails to enforce its maxOutputLength limit when entries are read through the asynchronous getDataAsync() path. A crafted ZIP with falsified small declared sizes and a high-compression DEFLATE payload can exhaust the memory of an application that reads entries asynchronously.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that parse ZIP files supplied by users or other untrusted parties using adm-zip 0.6.0 and the asynchronous getDataAsync() call are exposed, because that path skips the maxOutputLength guard. Services that only handle trusted archives or never read entries asynchronously are less exposed. The sources do not say whether the synchronous API is also affected.
No product ranges from the sources yet.
npm ls adm-zip; version 0.6.0 is the affected release named in the sources.getDataAsync( and for maxOutputLength to see whether untrusted ZIP files are read asynchronously with that guard set.0.6.0; the sources do not name a fixed version, so check the adm-zip release list.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the maxOutputLength guard by targeting the asynchronous getDataAsync() path in methods/inflater.js. Attackers can craft ZIP entries with falsified small declared sizes and high-ratio DEFLATE payloads to exhaust memory in applications reading entries asynchronously.
This page as .md · .json · in your agent: get_signal("CVE-2026-114103")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.