Denial of Service Vulnerability in adm-zip Node.js Library

CVE-2026-114102

What is CVE-2026-114102?

The adm-zip library, when used in versions prior to 0.6.1, presents a denial of service risk due to its inability to handle unhandled errors in the inflateAsync method. When an attacker sends a ZIP file containing malformed DEFLATE data, it can cause the Node.js process to crash. This issue arises from the lack of a zlib stream error listener in methods such as readFileAsync, readAsTextAsync, extractAllToAsync, and getDataAsync, which can trigger uncatchable exceptions and lead to the termination of all ongoing requests. Users should update to the latest version to mitigate this vulnerability.

References