The adm-zip library prior to version 0.5.18 is vulnerable to a denial of service attack via a crafted ZIP file that declares an excessively large uncompressed size in its central directory header. The vulnerability exists because the code allocates memory (Buffer.alloc) based on this declared size without bounds checking or validation against the actual compressed data size. This allows an attacker to cause a memory allocation amplification of over 33 million times, leading to immediate process crashes during extraction or reading operations. The flaw affects all extraction and read methods, including readFile(), readAsText(), extractEntryTo(), extractAllTo(), extractAllToAsync(), test(), and entry.getData(). The malicious payload cannot be rejected early because allocation occurs before CRC validation.

Applications using vulnerable versions of adm-zip that accept untrusted ZIP files are susceptible to denial of service via process crashes caused by excessive memory allocation. This can disrupt service availability and potentially lead to application instability or downtime. There is no indication of code execution or data corruption beyond denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted ZIP files with adm-zip versions prior to 0.5.18. Consider implementing additional input validation or sandboxing to limit impact.