CVE-2026-77301: adm-zip Node.js Library DOS Vulnerability

CVE-2026-77301 Overview

The adm-zip JavaScript library contains a memory allocation flaw that allows attackers to trigger service-wide memory exhaustion using a small crafted ZIP archive. The getData() function in zipEntry.js trusts the uncompressed size declared in a ZIP entry's central directory. It allocates output memory through Buffer.alloc before validating that value against the actual compressed payload. A multi-gigabyte size claim in a tiny file forces excessive resident memory allocation before CRC validation reports an error. Applications parsing archives from untrusted sources can be terminated by the operating system. The issue is fixed in adm-zip version 0.6.1 and is classified as [CWE-789: Memory Allocation with Excessive Size Value].

Critical Impact
A single crafted ZIP file can exhaust process memory and cause denial of service in any Node.js application that extracts untrusted archives with adm-zip prior to 0.6.1.

Affected Products

adm-zip npm package versions prior to 0.6.1
Node.js applications that read entries from untrusted ZIP archives using adm-zip
Services and CLI tools embedding vulnerable adm-zip releases as a dependency

Discovery Timeline

2026-09-18 - CVE-2026-77301 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-77301

Vulnerability Analysis

The flaw is a classic decompression bomb enabled by unchecked memory pre-allocation. When adm-zip reads a ZIP entry, getData() in zipEntry.js reads the uncompressed size from the central directory header. It then calls Buffer.alloc with that attacker-controlled value before the compressed stream is inflated or CRC-verified. An attacker crafts a ZIP whose central directory advertises a multi-gigabyte uncompressed size while the actual compressed body is only a few bytes. The runtime commits large resident memory pages during allocation and decompression handling. Only after this allocation does CRC validation fail and surface an error. By that point the host process may already be killed by the OS out-of-memory killer, or other tenants on the host may be starved of memory.

Root Cause

The library trusted a value from the untrusted archive without cross-checking it against the compressed data length or bounding the decompression output. The inflater also did not pass a maxOutputLength cap when the declared size was 0, allowing bombs that lie about their size to bypass the guard entirely.

Attack Vector

Exploitation requires no authentication or user interaction beyond triggering the application to read the malicious archive. Any Node.js service that accepts ZIP uploads, fetches archives over HTTP, or opens files from shared storage using adm-zip is exposed to remote denial of service.

javascript

// Patch: methods/inflater.js - cap decompression output at declared size
 const version = +(process?.versions?.node ?? "").split(".")[0] || 0;
+const Errors = require("../util/errors");
 
 module.exports = function (/*Buffer*/ inbuf, /*number*/ expectedLength) {
     var zlib = require("zlib");
-    const option = version >= 15 && expectedLength > 0 ? { maxOutputLength: expectedLength } : {};
+    // Cap decompression output at the entry's declared uncompressed size to bound
+    // decompression bombs. A declared size of 0 must not disable the cap: a
+    // genuinely empty entry inflates to 0 bytes, so a 1-byte floor still lets
+    // it through while stopping a bomb that lies about its size.
+    const maxOutputLength = expectedLength > 0 ? expectedLength : 1;
+    const option = version >= 15 ? { maxOutputLength } : {};

     return {
         inflate: function () {
// Source: https://github.com/cthackers/adm-zip/commit/491600683dacb6cb9fe0718a0eeb9cb5eb49afa6

Detection Methods for CVE-2026-77301

Indicators of Compromise

Node.js processes terminated by the Linux OOM killer shortly after receiving or opening user-supplied ZIP files.
Sudden spikes in resident set size (RSS) for services that expose archive upload or extraction endpoints.
Application logs containing BAD_CRC errors from adm-zip immediately preceded by allocation failures.

Detection Strategies

Inventory application dependencies with npm ls adm-zip or Software Bill of Materials (SBOM) tooling to identify versions below 0.6.1.
Review source code for calls to AdmZip, readAsText, extractAllTo, and getData that operate on untrusted input.
Add runtime alerts for process restarts and out-of-memory events on hosts running ZIP-processing workloads.

Monitoring Recommendations

Monitor container and pod memory metrics for anomalous allocation spikes correlated with archive ingestion.
Log ZIP entry metadata, including declared uncompressed size, and alert on ratios exceeding a sane compression bound.
Track dependency drift in CI so new builds cannot ship with vulnerable adm-zip versions.

How to Mitigate CVE-2026-77301

Immediate Actions Required

Upgrade adm-zip to version 0.6.1 or later across all Node.js applications and rebuild affected container images.
Audit services that process user-uploaded archives and place them behind size and rate limits.
Isolate archive extraction into separate worker processes with strict memory limits to contain any residual bombs.

Patch Information

The fix is available in adm-zip release v0.6.1. The corrective commit is documented in GitHub commit 4916006 and the coordinated advisory is GHSA-7q85-xj36-vmfc. The patch enforces a maxOutputLength cap on the zlib decompression path and adds a MAX_OUTPUT_EXCEEDED error so oversized inflations fail fast.

Workarounds

Reject uploaded ZIP files above a small maximum size at the network or application boundary.
Parse the central directory manually and refuse entries whose declared uncompressed size exceeds an application-defined ceiling.
Run extraction in a child process launched with --max-old-space-size and OS-level memory cgroup caps.

bash

# Update the vulnerable dependency and verify installed version
npm install adm-zip@^0.6.1
npm ls adm-zip

# Run extraction workers with bounded memory (example: 256 MB heap)
node --max-old-space-size=256 extract-worker.js