CVE-2026-39244

Name of the Vulnerable Software and Affected Versions adm-zip versions prior to 0.5.18

Description A denial-of-service issue exists when parsing crafted ZIP files with a manipulated uncompressed size header field. The library allocates memory based on the declared uncompressed size from the ZIP central directory header without validating it against the actual compressed data size or imposing an upper bound. This occurs in zipEntry.js via Buffer.alloc( centralHeader.size), where the size value is read from the binary header in entryHeader.js without bounds checking. An attacker can use a small ZIP file to trigger multi-gigabyte memory allocations, leading to memory exhaustion and immediate process crashes. This affects the following methods: readFile(), readAsText(), extractEntryTo(), extractAllTo(), extractAllToAsync(), test(), and entry.getData().

Recommendations Update to version 0.5.18.