CVE-2026-77301 in adm-zip
Summary
by MITRE • 09/18/2026
adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, getData() in zipEntry.js trusts an entry's central-directory uncompressed size and allocates output memory before validating that value against the actual compressed data and decompression result. A small crafted ZIP can declare a multi-gigabyte uncompressed size, causing Buffer.alloc and decompression handling to commit excessive resident memory before CRC validation reports an error. Applications that read entries from untrusted archives can therefore be terminated by the operating system or suffer service-wide memory exhaustion. This issue is fixed in version 0.6.1.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The adm-zip library, a widely used JavaScript utility for handling ZIP archive creation and extraction within Node.js environments, contains a critical resource management vulnerability that affects versions prior to 0.6.1. The core of this issue lies in the getData function located within zipEntry.js, which is responsible for retrieving the content of individual entries from an archive. In vulnerable implementations, the library prioritizes performance by pre-allocating memory based on metadata found in the ZIP file's central directory rather than validating the integrity and actual size requirements against the compressed data stream first. This architectural decision creates a significant window of opportunity for attackers to exploit the application through maliciously crafted input files that do not conform to expected structural norms or realistic compression ratios.
The technical flaw centers on how memory is allocated during the decompression process. When an entry's uncompressed size is read from the central directory, the library immediately invokes Buffer.alloc with this declared value to reserve space for the output data. This allocation occurs before any validation of whether the compressed payload actually contains enough bytes to justify such a large buffer or if the resulting decompressed stream would realistically match that size. Consequently, an attacker can construct a ZIP archive where a single entry declares an uncompressed size in the gigabytes range while containing only minimal actual data. Upon processing this file, Node.js attempts to allocate several gigabytes of resident memory for what is effectively empty or tiny content. This behavior bypasses standard safeguards because the allocation happens at the runtime level before any application-level logic can intervene or reject the suspicious entry based on size constraints.
The operational impact of this vulnerability is severe, primarily manifesting as a denial-of-service condition through resource exhaustion. Since Node.js applications typically run in environments with finite memory resources, such as cloud containers or shared hosting platforms, allocating excessive amounts of RAM for a single file operation can quickly deplete available system memory. This triggers the operating system's out-of-memory killer to terminate the process abruptly, causing service disruption for all users relying on that instance. Even if the application does not crash immediately, the excessive memory commitment can lead to performance degradation, increased latency, or eventual failure as swap space is exhausted. For applications processing untrusted archives uploaded by external parties, this vulnerability represents a straightforward path to destabilizing production infrastructure without requiring any authentication or complex exploitation techniques beyond file upload capabilities.
This flaw aligns with CWE-789: Memory Allocation with Excessive Size Value and CWE-400: Uncontrolled Resource Consumption. From an offensive security perspective, it maps directly to the ATT&CK technique T1496: Resource Hijacking, specifically under sub-techniques involving resource exhaustion via memory allocation attacks. The vulnerability exploits the trust placed in metadata fields within standard file formats, demonstrating how deviations from expected compression ratios can be leveraged to overwhelm system resources. It highlights a common pitfall in parsing libraries where performance optimizations that skip early validation steps can introduce significant security risks when processing untrusted data sources.
Mitigation for this issue is straightforward and involves updating the adm-zip dependency to version 0.6.1 or later, where the developers have corrected the allocation logic to validate sizes against actual compressed data before committing memory resources. For organizations unable to update immediately due to legacy constraints, implementing strict input validation at the application layer can provide a temporary buffer. This includes enforcing maximum allowed file sizes for uploads and validating ZIP entry metadata against reasonable thresholds before passing them to the library's extraction functions. Additionally, deploying resource limits such as cgroup memory restrictions in containerized environments or setting Node.js heap size limits can help contain the blast radius of any successful exploitation attempt, ensuring that a single malicious archive cannot consume all available system memory and take down the entire service instance.