Denial of Service Vulnerability in adm-zip: Unhandled Error Event in Async DEFLATE Decompression
Summary
GHSA-8238-w5pm-2374: adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS). Affects adm-zip versions < 0.6.1. Fixed in 0.6.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
adm-zip is a popular Node.js library used for creating, reading, and extracting ZIP files. It provides a simple API for handling ZIP archives, making it a go-to choice for developers needing to manage compressed file formats. However, a significant vulnerability has been identified in its async decompression API, which can lead to a Denial of Service (DoS) attack.
Vulnerability Detail
The vulnerability arises from the absence of an error listener in the async decompression method of adm-zip. Specifically, when a malformed ZIP file is processed, the zlib library emits an 'error' event without any registered listeners. This results in an uncaught exception that crashes the entire Node.js process. The impact is severe, as it allows unauthenticated attackers to disrupt services by simply uploading a malicious ZIP file, leading to a complete denial of service for all users on that Node.js instance.
How To Fix
Latest published version: 0.6.1 as of 23 Oct 2026
npm install adm-zip@0.6.1The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement your own error handling around the adm-zip async methods. For example, you can wrap the calls in a try-catch block and handle errors gracefully. However, this does not replace the need to update the package.
Conclusion
The adm-zip library has a critical vulnerability that can lead to a Denial of Service attack due to unhandled error events in its async decompression methods. It is crucial for developers using this library to update to the patched version to ensure the security and stability of their applications.
See every vulnerability recorded for adm-zip →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Any Node.js application that accepts untrusted ZIP uploads and uses adm-zip's async API is at risk of this vulnerability.
While the best solution is to update to the patched version, you can implement custom error handling to mitigate the risk temporarily.
If not fixed, your application could be exploited by attackers, leading to service disruptions and potential downtime for all users.
References
Related vulnerabilities
Recent vulnerabilities recorded for adm-zip.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
