CVE-2026-77301

Name of the Vulnerable Software and Affected Versions adm-zip versions prior to 0.6.1

Description The getData() function in zipEntry.js trusts the uncompressed size declared in a ZIP entry's central directory and allocates output memory using Buffer.alloc before validating this value against the actual compressed data and decompression result. A small, specially crafted ZIP file can declare a multi-gigabyte uncompressed size, forcing the system to commit excessive resident memory. This can lead to service-wide memory exhaustion or cause the operating system to terminate the process via an Out-Of-Memory (OOM) kill before CRC validation reports an error. This issue exposes applications that process untrusted archives to a remote denial of service.

Recommendations Update to version 0.6.1.