Memory exhaustion vulnerability in adm-zip library for Node.js

CVE-2026-77301

What is CVE-2026-77301?

The adm-zip library, used for creating and extracting ZIP archives in Node.js, is vulnerable to a memory exhaustion issue. When handling ZIP entries, the getData() method does not adequately validate the uncompressed size declared in the central directory against the actual data being decompressed. This oversight could allow an attacker to craft a malicious ZIP file that specifies a large uncompressed size, resulting in the allocation of excessive memory resources before verification occurs. As applications process untrusted archives, they risk being terminated by the operating system or experiencing widespread memory exhaustion. The vulnerability has been addressed in version 0.6.1.

References