CVE-2026-92000: adm-zip DOS Vulnerability

CVE-2026-92000 Overview

CVE-2026-92000 is a denial-of-service vulnerability in the adm-zip Node.js library, affecting versions 0.5.14 through 0.6.0. The library fails to enforce zlib decompression output limits when a ZIP entry declares an uncompressed size of zero. Attackers can craft a malicious ZIP archive containing highly compressible entries with a declared size of zero to trigger unbounded memory allocation during inflation. Any application that parses untrusted ZIP archives with a vulnerable version can be crashed through memory exhaustion. The flaw is categorized under [CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)].

Critical Impact
A single malicious ZIP file can exhaust process memory and terminate Node.js applications that ingest attacker-supplied archives.

Affected Products

adm-zip version 0.5.14
adm-zip versions between 0.5.14 and 0.6.0
adm-zip version 0.6.0

Discovery Timeline

2026-09-15 - CVE-2026-92000 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-92000

Vulnerability Analysis

The adm-zip library wraps Node.js zlib to inflate compressed ZIP entries. On Node.js version 15 and later, zlib supports a maxOutputLength option that bounds decompressed output size. The vulnerable code only applied that cap when expectedLength > 0. When a ZIP entry header declares an uncompressed size of zero, the library omitted the cap entirely and allowed zlib to inflate without limit.

An attacker packs a highly compressible payload, such as a stream of null bytes, into a ZIP entry and sets the declared uncompressed size field to zero. On decompression, memory grows until the Node.js process is terminated by the operating system or hits the V8 heap limit. This is a classic decompression-bomb pattern where the amplification ratio is controlled by the attacker.

Root Cause

The root cause resides in methods/inflater.js. The conditional expectedLength > 0 ? { maxOutputLength: expectedLength } : {} treated a zero declared size as a signal to disable the safety cap. Combined with an async inflation path that also lacked the cap, this created two code paths where a malformed ZIP could bypass output-size enforcement.

Attack Vector

Exploitation requires only that a vulnerable application call adm-zip extraction or inflation APIs on an attacker-controlled ZIP archive. No authentication, user interaction, or local access is required. Common exposure points include file upload handlers, email attachment scanners, package registries, CI/CD pipelines, and any service that unpacks user-supplied archives.

javascript

// Security patch in methods/inflater.js (commit 49160068)
// Enforces the decompression size cap on the async path and for size 0
 const version = +(process?.versions?.node ?? "").split(".")[0] || 0;
+const Errors = require("../util/errors");
 
 module.exports = function (/*Buffer*/ inbuf, /*number*/ expectedLength) {
     var zlib = require("zlib");
-    const option = version >= 15 && expectedLength > 0 ? { maxOutputLength: expectedLength } : {};
+    // Cap decompression output at the entry's declared uncompressed size to bound
+    // decompression bombs (CVE-2026-39244). A declared size of 0 must not disable
+    // the cap: a genuinely empty entry inflates to 0 bytes, so a 1-byte floor
+    // still lets it through while stopping a bomb that lies about its size
+    // (GHSA-rcw4-f5rp-g42v). zlib requires maxOutputLength >= 1.
+    const maxOutputLength = expectedLength > 0 ? expectedLength : 1;
+    const option = version >= 15 ? { maxOutputLength } : {};
 
     return {
         inflate: function () {

Source: GitHub Commit 49160068

Detection Methods for CVE-2026-92000

Indicators of Compromise

Node.js processes terminating with JavaScript heap out of memory errors shortly after ZIP ingestion.
ZIP archives whose central directory entries declare an uncompressed size of 0 but contain non-trivial compressed payloads.
Sudden spikes in resident set size (RSS) or container OOM kills correlated with archive upload endpoints.

Detection Strategies

Inventory Node.js applications and inspect package-lock.json or yarn.lock for adm-zip versions 0.5.14 through 0.6.0.
Use Software Composition Analysis (SCA) tooling to flag transitive dependencies pulling in vulnerable adm-zip releases.
Instrument archive-processing code paths to log entries where header.size === 0 and header.compressedSize > 0.

Monitoring Recommendations

Alert on repeated OOM kills of services that expose archive upload or extraction functionality.
Track memory allocation growth patterns in Node.js runtimes handling untrusted input.
Correlate web application firewall (WAF) logs of large or anomalous ZIP uploads with backend process restarts.

How to Mitigate CVE-2026-92000

Immediate Actions Required

Upgrade adm-zip to a version that includes the fix from commits 49160068 and 8bc41118.
Audit all services that call adm-zip on untrusted input and prioritize internet-facing upload endpoints.
Enforce upload size limits and per-request memory ceilings at the application or proxy layer.

Patch Information

The maintainers addressed the flaw across two commits. Commit 49160068 applies a minimum maxOutputLength of 1 when the declared entry size is zero, ensuring the zlib cap is always active on Node.js 15+ and on the async inflation path. Commit 8bc41118 fixes a regression in the added parameter handling. Review the GitHub Security Advisory GHSA-rcw4-f5rp-g42v and the Vulncheck Advisory for the authoritative fixed version.

Workarounds

Reject ZIP entries whose declared uncompressed size is zero but whose compressed size is non-zero before calling adm-zip inflation.
Run archive-processing workers in isolated processes with hard memory limits enforced via cgroups or container resource caps.
Pre-scan uploads with a size and compression-ratio heuristic and reject archives exceeding a defined amplification threshold.

bash

# Configuration example: enforce a Node.js heap ceiling for archive workers
node --max-old-space-size=256 archive-worker.js

# Container-level memory cap for defense in depth
docker run --memory=512m --memory-swap=512m archive-worker:latest