Adm-zip before 0.6.1 contains an incorrect permission assignment vulnerability that allows attackers to set setuid, setgid, or sticky bits on extracted files when keepOriginalPermission is enabled. Attackers can craft zip external file attributes that pass unmasked into chmod, letting attacker-controlled executables gain elevated privileges when extracted as root and later run.
adm-zip versions before 0.6.1 have a vulnerability where ZIP archives with duplicate entry names cause inconsistent entry resolution. This allows attackers to bypass content validation because getEntry() returns the last duplicate entry while extractAllTo() writes the first, potentially writing unvalidated data to disk.
CVE-2026-114103 is a medium severity vulnerability in adm-zip version 0.6.0 that allows attackers to bypass decompression bomb protections. The flaw exists in the asynchronous getDataAsync() method where attackers can craft ZIP entries with small declared sizes but highly compressed payloads, leading to uncontrolled memory exhaustion.
adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.js process via a malformed ZIP file, because inflateAsync in methods/inflater.js lacks a zlib stream error listener. Attackers can supply a ZIP with corrupted DEFLATE data processed by readFileAsync, readAsTextAsync, extractAllToAsync, or getDataAsync, triggering an uncatchable exception that terminates all in-flight requests.
CVE-2026-102282 is a vulnerability in the adm-zip JavaScript library for Node.js that allows incorrect permission assignment during ZIP extraction. Versions prior to 0.6.1 apply Unix permission bits from ZIP entries directly to extracted files without filtering out setuid/setgid/sticky bits. When extraction occurs with root privileges and the keepOriginalPermission flag is used, an attacker can craft a ZIP archive that results in a root-owned setuid binary. This can lead to privilege escalation when a less privileged user executes the extracted binary. Version 0.6.1 addresses this issue.
adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, getData() in zipEntry.js trusts an entry's central-directory uncompressed size and allocates output memory before validating that value against the actual compressed data and decompression result. A small crafted ZIP can declare a multi-gigabyte uncompressed size, causing Buffer.alloc and decompression handling to commit excessive resident memory before CRC validation reports an error. Applications that read entries from untrusted archives can therefore be terminated by the operating system or suffer service-wide memory exhaustion. This issue is fixed in version 0.6.1.
adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP entries declare zero uncompressed size. Attackers can craft malicious ZIP archives with highly compressible entries declaring zero size to exhaust memory and cause denial of service.
CVE-2026-76845 is a vulnerability in cthackers adm-zip versions 0.5.9 through 0.6.0 where symbolic links are followed during archive extraction, allowing an attacker to write files outside the intended extraction directory. This occurs because the sanitization only compares string paths without properly preventing symbolic link traversal, and the extraction functions open files without safeguards against link following. An attacker who can place a symbolic link inside a shared or predictable extraction directory can cause arbitrary file overwrite if the extracting process has write permissions and overwrite is enabled.