CVE-2026-92000: adm-zip Decompression Bomb Bypass Vulnerability
Summary
CVE-2026-92000: Affected package: adm-zip (npm) Affected version: 0.6.0 Summary The fix shipped for CVE-2026-39244 (methods/inflater.js) caps zlib's decompression output via maxOutputLength: expectedLength, where expectedLength is read... Affects adm-zip versions < 0.6.1. Fixed in 0.6.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
adm-zip is a popular npm package used for reading and extracting ZIP files in Node.js applications. It provides a simple API for handling ZIP archives, making it a convenient choice for developers needing to manage compressed files. However, it has a critical vulnerability that allows attackers to exploit the decompression process, leading to potential resource exhaustion.
Vulnerability Detail
The vulnerability arises from a flaw in the decompression logic of adm-zip, specifically in how it handles the 'uncompressed size' field in ZIP file headers. The fix for CVE-2026-39244 introduced a cap on the decompression output size based on this field. However, if an attacker sets the uncompressed size to zero, the cap is bypassed, allowing for excessive memory allocation during decompression. This can lead to denial of service (DoS) as the application may consume large amounts of memory, risking crashes or out-of-memory (OOM) errors.
How To Fix
Latest published version: 0.6.1 as of 23 Oct 2026
npm install adm-zip@0.6.1The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement a check in your application to validate the uncompressed size field before processing ZIP files. If the uncompressed size is zero, reject the file or handle it with caution. Example code snippet:
const AdmZip = require('adm-zip');
function safeExtract(zipBuffer) {
const zip = new AdmZip(zipBuffer);
const entries = zip.getEntries();
entries.forEach(entry => {
if (entry.header.uncompressedSize === 0) {
throw new Error('Invalid ZIP entry: uncompressed size is zero.');
}
// Proceed with extraction
});
}
Conclusion
The CVE-2026-92000 vulnerability in the adm-zip package poses significant risks due to its ability to bypass decompression limits. It is crucial for developers to update to the latest version to protect their applications from potential resource exhaustion attacks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for adm-zip →
FAQ
CVE-2026-92000 is a vulnerability in the adm-zip package that allows attackers to bypass decompression size limits, potentially leading to excessive memory consumption.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your package-lock.json.
The main consequence is the risk of denial of service (DoS) due to excessive memory allocation, which can crash your application or lead to performance degradation.
You can update the adm-zip package by running the command 'npm install adm-zip@0.6.1' in your project directory to ensure you have the patched version.
If you cannot update immediately, implement a validation check for the uncompressed size field in ZIP files before processing them to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for adm-zip.
