CVE-2026-114102 in adm-zip
Summary
by MITRE • 10/21/2026
adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.js process via a malformed ZIP file, because inflateAsync in methods/inflater.js lacks a zlib stream error listener. Attackers can supply a ZIP with corrupted DEFLATE data processed by readFileAsync, readAsTextAsync, extractAllToAsync, or getDataAsync, triggering an uncatchable exception that terminates all in-flight requests.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified in adm-zip versions prior to 0.6.1 represents a critical reliability flaw within the Node.js ZIP file processing library, specifically categorized under CWE-400: Uncontrolled Resource Consumption and CWE-252: Unchecked Return Value. This issue stems from an incomplete error handling mechanism during the asynchronous decompression of DEFLATE data contained within ZIP archives. The core technical defect resides in the inflateAsync function located in methods/inflater.js, which fails to attach a zlib stream error listener. In Node.js environments, unhandled promise rejections or uncaught exceptions originating from async operations can propagate up the call stack without being intercepted by standard try-catch blocks if not explicitly managed within the asynchronous flow. Consequently, when the library processes a ZIP file containing corrupted DEFLATE data through methods such as readFileAsync, readAsTextAsync, extractAllToAsync, or getDataAsync, the underlying zlib stream encounters an irrecoverable error during decompression. Because no listener is present to catch this specific type of stream failure, the exception remains unhandled and terminates the entire Node.js process immediately.
From a security operations perspective, this vulnerability enables a straightforward denial-of-service attack against any application relying on adm-zip for archive extraction or inspection. An attacker does not require authentication to exploit this flaw; they simply need to supply a maliciously crafted ZIP file with corrupted internal compression streams. The impact is severe because the termination of the Node.js process results in an immediate and total loss of service availability for all concurrent requests handled by that instance. This aligns with MITRE ATT&CK technique T1499: Endpoint Denial of Service, where adversaries aim to disrupt or deny services to legitimate users rather than stealing data or gaining persistent access. The lack of graceful degradation means that even a single malformed file can take down the entire server process, leading to significant operational downtime and potential cascading failures in microservices architectures if this library is used as part of a larger request handling pipeline.
Mitigation strategies must prioritize immediate version upgrades for all systems utilizing adm-zip. Organizations should update their dependencies to version 0.6.1 or later, where the developers have implemented proper error listeners to handle zlib stream errors gracefully. For environments that cannot immediately upgrade due to compatibility constraints, temporary workarounds involve wrapping calls to vulnerable methods like extractAllToAsync and getDataAsync in robust try-catch blocks if possible, although this may not fully prevent process termination depending on how the library propagates the unhandled rejection. Additionally, implementing input validation at the network perimeter or application gateway level can help filter out obviously malformed ZIP files before they reach the Node.js runtime. Regular auditing of third-party dependencies and monitoring for unexpected process crashes are essential practices to detect such vulnerabilities in production environments early.