CVE-2026-92000
adm-zip 0.5.14 through 0.6.0 Denial of Service via Zero Declared Uncompressed Size
- State
- Published
- Severity
- 8.7 High
- Published
- Sep 15, 2026
- Updated
- Sep 24, 2026
- Reserved
- Sep 15, 2026
Description
adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP entries declare zero uncompressed size. Attackers can craft malicious ZIP archives with highly compressible entries declaring zero size to exhaust memory and cause denial of service.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | VulnCheck |
Weaknesses
- CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)
Affected Products
| Product | Versions |
|---|---|
adm-zipcthackers |
|
References
- GitHub Security Advisory (GHSA-rcw4-f5rp-g42v)vendor-advisory
- Fix commit (0.6.1)patch
- Commit introducing the conditional cap (0.5.14)technical-descriptionpatch
- Vulnerable inflater.js at v0.6.0technical-description
- https://github.com/cthackers/adm-zipproduct
- VulnCheck Advisory: adm-zip 0.5.14 through 0.6.0 Denial of Service via Zero Declared Uncompressed Sizethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.