CVE-2026-42886: Audiobookshelf DOS Vulnerability

CVE-2026-42886 Overview

CVE-2026-42886 is a denial-of-service vulnerability in Audiobookshelf, a self-hosted audiobook and podcast server. The flaw affects versions prior to 2.32.2 and resides in the POST /api/backups/upload endpoint. The endpoint decompresses the details entry from an uploaded .audiobookshelf ZIP archive entirely into memory using zip.entryData() without enforcing any size limit. The upload middleware also lacks a file size restriction. An authenticated admin user can submit a crafted ZIP archive containing a highly compressed entry that expands to hundreds of megabytes or gigabytes when processed. The vulnerability is tracked as [CWE-409] (Improper Handling of Highly Compressed Data) and is fixed in version 2.32.2.

Critical Impact
An authenticated administrator can crash the Audiobookshelf server process through out-of-memory conditions by uploading a maliciously crafted ZIP backup file, resulting in service disruption for all users.

Affected Products

Audiobookshelf versions prior to 2.32.2
The POST /api/backups/upload endpoint
Self-hosted Audiobookshelf deployments accepting backup uploads

Discovery Timeline

2026-05-11 - CVE-2026-42886 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-42886

Vulnerability Analysis

The vulnerability is a classic decompression bomb scenario, often referred to as a ZIP bomb. Audiobookshelf accepts backup archives via the POST /api/backups/upload endpoint. When processing the archive, the server reads the details entry using the zip.entryData() method, which loads the fully decompressed content into memory in a single operation. The implementation enforces no upper bound on either the compressed input size or the decompressed output size. An attacker with administrative privileges can craft a ZIP archive containing an entry with a high compression ratio. A few kilobytes of compressed data can expand to gigabytes once decompressed, exhausting available memory on the host. The Node.js process terminates when the operating system kills it under memory pressure, halting all Audiobookshelf services.

Root Cause

The root cause is the absence of two safeguards: the upload middleware does not cap the size of incoming files, and the ZIP processing logic does not stream entries or check decompressed entry sizes before allocating memory. Using zip.entryData() instead of a bounded streaming reader makes the application vulnerable to compression-ratio amplification attacks.

Attack Vector

Exploitation requires valid administrative credentials, which limits the threat surface to insiders or attackers who have already compromised an admin account. The attacker authenticates to the Audiobookshelf web interface or API, then sends a crafted .audiobookshelf ZIP file to the backup upload endpoint. The server attempts to read the details entry and allocates memory equal to the decompressed size. No verified public proof-of-concept is published. See the GitHub Security Advisory for technical details.

Detection Methods for CVE-2026-42886

Indicators of Compromise

Sudden termination of the Audiobookshelf process with out-of-memory (OOM) signals in system logs or dmesg output
HTTP requests to POST /api/backups/upload originating from administrator sessions with unusually small request bodies relative to subsequent memory spikes
Backup files with extreme compression ratios present in the uploads directory

Detection Strategies

Monitor the Audiobookshelf process for abnormal resident set size (RSS) growth following requests to the backup upload endpoint
Inspect reverse proxy or load balancer access logs for POST /api/backups/upload activity correlated with service restarts
Validate uploaded ZIP archives against expected file size and entry size ranges using offline tooling

Monitoring Recommendations

Configure host-level memory and process restart alerting on the Audiobookshelf service
Forward web server access logs to a centralized log platform and alert on repeated administrative uploads followed by 5xx responses
Track admin account authentication events to detect credential compromise that could precede exploitation

How to Mitigate CVE-2026-42886

Immediate Actions Required

Upgrade Audiobookshelf to version 2.32.2 or later, which contains the official fix
Restrict network access to the Audiobookshelf administrative interface to trusted IP ranges
Audit admin accounts and rotate credentials for any accounts with weak or shared passwords
Enable multi-factor authentication for administrator logins where supported by your deployment

Patch Information

The Audiobookshelf maintainers fixed the issue in version 2.32.2. The patch is described in the GitHub Security Advisory GHSA-4jq4-rvq8-j26h. Administrators running self-hosted deployments should pull the latest container image or release artifact and restart the service.

Workarounds

Place Audiobookshelf behind a reverse proxy such as nginx or Caddy that enforces a maximum request body size on the backup upload route
Limit administrative access by network segmentation until the upgrade is applied
Run Audiobookshelf with strict container memory limits so an OOM event does not affect other workloads on the host

bash

# nginx example: cap upload size on the backup endpoint to 50MB
location /api/backups/upload {
    client_max_body_size 50m;
    proxy_pass http://audiobookshelf_upstream;
}