Chan154

adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.js process via a malformed ZIP file, because inflateAsync in methods/inflater.js lacks a zlib stream error listener. Attackers can supply a ZIP with corrupted DEFLATE data processed by readFileAsync, readAsTextAsync, extractAllToAsync, or getDataAsync, triggering an uncatchable exception that terminates all in-flight requests.

**Name of the Vulnerable Software and Affected Versions** Axios versions 0.28.0 through 0.33.x Axios versions 1.15.1 through 1.19.x **Description** ToFormData processes inherited serialization options and visitor properties supplied through prototype pollution, a condition where an attacker can manipulate the prototype of an object to inject properties. A separate same-process prototype pollution flaw allows the supply of inherited `dots`, `indexes`, `metaTokens`, `maxDepth`, `visitor`, or `Blob` values before object serialization. These inherited options can alter field naming and data interpretation in toFormData, while `maxDepth` can force request failure and `Blob` can change value handling. Additionally, a polluted `visitor` can execute if an attacker possesses the ability to inject a function. **Recommendations** Update to version 0.34.0. Update to version 1.20.0.