CVE-2026-39244: adm-zip Denial of Service via Crafted ZIP File
Summary
CVE-2026-39244: adm-zip: Crafted ZIP file triggers 4GB memory allocation. Affects adm-zip versions < 0.6.0. Fixed in 0.6.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
adm-zip is a popular npm package used for reading and writing ZIP files in Node.js applications. It provides a simple API for file extraction and manipulation, making it a convenient choice for developers working with compressed file formats. However, a critical vulnerability has been identified in versions prior to 0.5.18, which can lead to severe denial of service issues when handling untrusted ZIP files.
Vulnerability Detail
The vulnerability in adm-zip arises from improper validation of the uncompressed size header field in ZIP files. Specifically, in zipEntry.js, memory is allocated based on the declared uncompressed size without checking it against the actual compressed data size or imposing any limits. An attacker can exploit this by crafting a small ZIP file that claims to have a 4GB uncompressed size, leading to excessive memory allocation and potential process crashes. This vulnerability affects all extraction and reading methods, including readFile(), readAsText(), extractEntryTo(), extractAllTo(), extractAllToAsync(), test(), and entry.getData().
How To Fix
Latest published version: 0.6.1 as of 23 Oct 2026
npm install adm-zip@0.6.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.6.0
This is the first release that contains the fix.
npm install adm-zip@0.6.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing input validation to reject ZIP files with suspicious uncompressed size declarations. This can help mitigate the risk until the package is updated.
Conclusion
The adm-zip package has a critical vulnerability that can lead to denial of service through crafted ZIP files. It is essential to update to version 0.6.0 or later to mitigate this risk. Additionally, using tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for adm-zip →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
All versions of adm-zip prior to 0.5.18 are affected by this vulnerability.
Any application that uses adm-zip to handle untrusted ZIP files is at risk of denial of service due to this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If you cannot update the package, implement input validation to reject ZIP files with suspicious uncompressed size declarations as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for adm-zip.
