DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-77301: CVE-2026-77301: Uncontrolled Resource Allocation (Decompression Bomb) in adm-zip

#security #cve #cybersecurity

CVE-2026-77301: Uncontrolled Resource Allocation (Decompression Bomb) in adm-zip

Vulnerability ID: CVE-2026-77301
CVSS Score: 7.5
Published: 2026-09-18

CVE-2026-77301 is a critical uncontrolled resource allocation vulnerability in the popular Node.js library adm-zip (versions prior to 0.6.1). During ZIP decompression of asynchronous entries, the library trusts the uncompressed size metadata declared in the central directory headers. Because Node.js's streaming zlib API completely ignores the maxOutputLength configuration, a crafted ZIP archive (decompression bomb) causes the application to continually allocate resident memory buffers on the heap without limits, causing rapid memory exhaustion and a process-level Out-of-Memory (OOM) crash.

TL;DR

Uncontrolled memory allocation in adm-zip before 0.6.1 allows unauthenticated remote attackers to trigger a Denial of Service (DoS) via a crafted ZIP archive (decompression bomb) that exhausts Node.js heap memory.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-789 / CWE-770
  • Attack Vector: Network (AV:N)
  • CVSS v3.1 Score: 7.5 (High)
  • Exploit Status: PoC (Proof of Concept)
  • CISA KEV Status: Not Listed
  • Impact: Complete Denial of Service (DoS) via OOM Crash

Affected Systems

  • Node.js environments utilizing the adm-zip package for ZIP archive parsing
  • adm-zip: < 0.6.1 (Fixed in: 0.6.1)

Code Analysis

Commit: 4916006

Cap decompression output at the entry's declared uncompressed size to bound decompression bombs

Mitigation Strategies

  • Upgrade adm-zip dependency to version 0.6.1 or later
  • Implement maximum file size checks at the API gateway or reverse proxy level
  • Validate file types before sending payloads to parser functions

Remediation Steps:

  1. Run the command 'npm install adm-zip@latest' or specify '"adm-zip": "^0.6.1"' in your package.json file.
  2. Run 'npm audit' to ensure that no transitive dependencies are pulling in older versions of the library.
  3. Deploy input-validation middleware to inspect incoming HTTP request bodies and drop payloads exceeding safe limits before parsing.

References

Read the full report for CVE-2026-77301 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)