CVE-2026-39244 Overview
CVE-2026-39244 is a denial-of-service vulnerability in the adm-zip Node.js library before version 0.5.18. The flaw stems from unchecked memory allocation based on the uncompressed size declared in a ZIP central directory header. An attacker can craft a ~120-byte ZIP file that declares a ~4GB uncompressed size, producing a memory allocation amplification ratio exceeding 33 million to 1. Because the allocation occurs before CRC validation, the malicious payload cannot be rejected early. Any application accepting untrusted ZIP files through adm-zip is exposed to an immediate process crash. The issue is tracked under [CWE-400] Uncontrolled Resource Consumption.
Critical Impact
A single ~120-byte ZIP file can trigger a ~4GB memory allocation, crashing any Node.js process that parses untrusted ZIP input with vulnerable adm-zip versions.
Affected Products
- adm-zip npm package versions before 0.5.18
- Node.js applications using adm-zip to parse untrusted ZIP files
- Server-side services exposing file upload or archive extraction endpoints backed by adm-zip
Discovery Timeline
- 2026-07-10 - CVE-2026-39244 published to NVD
- 2026-07-10 - Last updated in NVD database
Technical Details for CVE-2026-39244
Vulnerability Analysis
The vulnerability resides in how adm-zip handles the uncompressed size field from ZIP central directory headers. In zipEntry.js at line 103, the library calls Buffer.alloc(_centralHeader.size) using the declared uncompressed size directly from the archive metadata. No upper bound is enforced and the value is never cross-checked against the actual compressed payload size on disk.
The raw size value is read from the binary header at entryHeader.js line 266 without bounds validation. Because Node.js Buffer.alloc eagerly reserves memory, a header claiming ~4GB forces the runtime to attempt a matching allocation. On typical servers this exhausts available heap and terminates the process.
All extraction and read paths inherit the flaw, including readFile(), readAsText(), extractEntryTo(), extractAllTo(), extractAllToAsync(), test(), and entry.getData(). Applications cannot avoid the issue by choosing a specific API surface.
Root Cause
The root cause is missing input validation on attacker-controlled length fields prior to memory allocation. The library trusts declared header values instead of clamping them to a safe maximum or comparing them against the compressed stream length.
Attack Vector
An attacker delivers a crafted ZIP file to any endpoint that parses archives with adm-zip. The attack requires no authentication and no user interaction beyond routine archive handling. Common exposure includes file upload endpoints, email attachment scanners, CI/CD artifact processors, and package management tooling.
No verified proof-of-concept code is published for CVE-2026-39244. The vulnerability mechanism is documented in the adm-zip GitHub issue tracker and the adm-zip source repository.
Detection Methods for CVE-2026-39244
Indicators of Compromise
- Node.js processes terminating with RangeError: Array buffer allocation failed or out-of-memory errors shortly after ZIP intake.
- ZIP files with extremely small on-disk size but central directory entries declaring uncompressed sizes in the gigabyte range.
- Repeated crashes or restarts of archive-processing workers following untrusted uploads.
Detection Strategies
- Inventory Node.js dependencies with npm ls adm-zip and flag any resolved version below 0.5.18.
- Instrument archive-processing code paths to log declared uncompressed size and compressed size ratios for each entry.
- Alert when compression ratios exceed a defensible threshold, for example 1000:1, prior to invoking adm-zip extraction.
Monitoring Recommendations
- Monitor process memory growth and OOM-kill events on services that accept user-supplied archives.
- Track HTTP 5xx spikes and worker restart counts on file upload endpoints.
- Capture and retain rejected or malformed ZIP samples for offline analysis and signature development.
How to Mitigate CVE-2026-39244
Immediate Actions Required
- Upgrade adm-zip to version 0.5.18 or later across all projects and container images.
- Rebuild and redeploy applications that bundle adm-zip transitively through other dependencies.
- Restrict archive-processing services behind authenticated interfaces where feasible.
Patch Information
Upgrade the adm-zip package to version 0.5.18 or later. Refer to the adm-zip package on npm and the upstream repository for release notes and fix commits. After upgrading, verify the resolved version using npm ls adm-zip because transitive dependencies may pin older releases.
Workarounds
- Reject uploaded ZIP files above an application-defined maximum on-disk size before parsing.
- Pre-validate ZIP central directory entries with a hardened parser and drop archives whose declared uncompressed size exceeds a safe threshold.
- Isolate ZIP processing in a resource-limited worker or container with strict memory caps so a crash cannot affect the primary service.
# Configuration example
npm install adm-zip@^0.5.18
npm ls adm-zip
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
