CVE-2026-114102

Deferred Deferred - Pending Action

Denial of Service in adm-zip via Malformed ZIP File

Publication date: 2026-10-21

Last updated on: 2026-10-22

Assigner: VulnCheck

Description

adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.js process via a malformed ZIP file, because inflateAsync in methods/inflater.js lacks a zlib stream error listener. Attackers can supply a ZIP with corrupted DEFLATE data processed by readFileAsync, readAsTextAsync, extractAllToAsync, or getDataAsync, triggering an uncatchable exception that terminates all in-flight requests.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-22

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-08

NVD

CVE-2026-114102

EUVD

EUVD-2026-106905

Affected Vendors & Products

Vendor	Product	Version / Range
cthackers	adm-zip	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-248	An exception is thrown from a function, but it is not caught.

Attack-Flow Graph

Executive Summary

This is a Denial of Service (DoS) vulnerability in the adm-zip npm package versions before 0.6.1. It occurs because the inflateAsync function lacks a zlib stream error listener. Attackers can crash the Node.js process by sending a malformed ZIP file with corrupted DEFLATE data. This triggers an uncatchable exception in functions like readFileAsync or extractAllToAsync, terminating all in-flight requests.

Detection Guidance

To detect this vulnerability, monitor for crashes in Node.js processes handling ZIP files. Check logs for unhandled exceptions from adm-zip async functions like readFileAsync or extractAllToAsync. Test by sending malformed ZIP files to applications using adm-zip <=0.6.0 and observe if the process crashes.

Impact Analysis

If you use adm-zip <=0.6.0 in a Node.js application, an attacker could send a malicious ZIP file to crash your entire Node.js server. This causes a full process-level denial of service, disrupting all services relying on that process. It affects any application processing untrusted ZIP uploads via adm-zip's async APIs.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling denial of service attacks that disrupt services handling sensitive data. GDPR requires availability of personal data processing systems, while HIPAA mandates access to protected health information. A DoS attack crashing Node.js processes could violate these availability requirements.

Mitigation Strategies

Upgrade adm-zip to version 0.6.1 or later. If upgrading is not possible, implement error handling for zlib streams in inflateAsync or switch to synchronous APIs. Block or sanitize ZIP file uploads until patched.

Hi! I’m here to help you understand CVE-2026-114102. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...