---
id: "CVE-2026-114103"
kind: "vulnerability"
aliases: ["CVE-2026-114103"]
title: "adm-zip: async extraction skips decompression bomb guard, exhausting memory"
severity: "medium"
cvss: 6.9
epss: 0.0027
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["adm-zip", "node.js", "package", "self-hosted"]
not_affected_if: ["no-async-zip-reads", "trusted-input-only"]
published_at: "2026-10-21T01:17:36+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-25T03:40:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114103", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114103", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# adm-zip: async extraction skips decompression bomb guard, exhausting memory

adm-zip 0.6.0 fails to enforce its maxOutputLength limit when entries are read through the asynchronous getDataAsync() path. A crafted ZIP with falsified small declared sizes and a high-compression DEFLATE payload can exhaust the memory of an application that reads entries asynchronously.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version with `npm ls adm-zip`; version `0.6.0` is the affected release named in the sources.
- Search the code for `getDataAsync(` and for `maxOutputLength` to see whether untrusted ZIP files are read asynchronously with that guard set.

## Fix

- Upgrade adm-zip past `0.6.0`; the sources do not name a fixed version, so check the adm-zip release list.
- Until upgraded, read untrusted archives with the synchronous path or reject uploads above a size limit before parsing.

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114103
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114103

## From the sources

adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the maxOutputLength guard by targeting the asynchronous getDataAsync() path in methods/inflater.js. Attackers can craft ZIP entries with falsified small declared sizes and high-ratio DEFLATE payloads to exhaust memory in applications reading entries asynchronously.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_