What’s Vulnerable › Vulnerabilities

CVE-2026-92000: adm-zip 0.5.14 through 0.6.0 Denial of Service via Zero Declared Uncompressed Size

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-15 · updated 2026-09-24
• Weakness: CWE-409

Description

adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP entries declare zero uncompressed size. Attackers can craft malicious ZIP archives with highly compressible entries declaring zero size to exhaust memory and cause denial of service.

Affected products

• cthackers adm-zip: from 0.5.14 before 0.6.1 — fixed in 0.6.1

How to fix

Upgrade to a fixed version: cthackers adm-zip 0.6.1. Check the vendor advisory for mitigations.

References

• https://github.com/cthackers/adm-zip
• https://github.com/cthackers/adm-zip/blob/v0.6.0/methods/inflater.js
• https://github.com/cthackers/adm-zip/commit/491600683dacb6cb9fe0718a0eeb9cb5eb49afa6
• https://github.com/cthackers/adm-zip/commit/8bc411184de1b5ca28138c53074fb61119994dde
• https://github.com/cthackers/adm-zip/security/advisories/GHSA-rcw4-f5rp-g42v
• https://www.vulncheck.com/advisories/adm-zip-0.5.14-through-0.6.0-denial-of-service-via-zero-declared-uncompressed-size

Get alerted when CVE-2026-92000 or the next vulnerability affects your stack