CVE-2026-77301: adm-zip Uncontrolled Memory Allocation Vulnerability Leading to Denial of Service

Sponsored Habilume Habit tracker with a companion that grows with you Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent. App Store Google Play

Background

adm-zip is a popular Node.js package used for reading and writing ZIP files. It allows developers to easily manipulate ZIP archives in their applications. However, it has a critical vulnerability that can lead to uncontrolled memory allocation, which poses a significant risk to applications that handle untrusted ZIP files.

Vulnerability Detail

The vulnerability arises from adm-zip's method of allocating memory for an entry's output buffer based on the declared uncompressed size in the ZIP file's central directory. This allocation occurs before validating the declared size against the actual data, allowing an attacker to craft a small ZIP file that declares a massive uncompressed size. For instance, a 105-byte ZIP can trigger a memory allocation of approximately 1.8 GB, leading to potential out-of-memory (OOM) errors on memory-constrained systems. This can result in a denial of service, as the application may crash or become unresponsive due to excessive memory consumption.

npm install adm-zip@0.6.1

Workaround

As a temporary workaround, you can implement input validation to reject ZIP files with implausible declared sizes before passing them to adm-zip. This can help mitigate the risk of memory exhaustion. Here is a sample code snippet for validation:

const AdmZip = require('adm-zip');

function validateZip(buffer) {
    const zip = new AdmZip(buffer);
    const entries = zip.getEntries();
    for (const entry of entries) {
        if (entry.data.length > MAX_SIZE) {
            throw new Error('Invalid ZIP entry size');
        }
    }
    return zip;
}

const MAX_SIZE = 104857600; // Example max size of 100 MB

Conclusion

In summary, CVE-2026-77301 is a critical vulnerability in the adm-zip package that can lead to denial of service through uncontrolled memory allocation. It is essential to update to the patched version 0.6.1 or later to mitigate this risk. Additionally, implementing input validation can serve as a temporary workaround.

See every vulnerability recorded for adm-zip →

FAQ