Medium severity · published Oct 21, 2026
CVE-2026-114103
adm-zip 0.6.0 Decompression Bomb Guard Bypass via getDataAsync()
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the maxOutputLength guard by targeting the asynchronous getDataAsync() path in methods/inflater.js. Attackers can craft ZIP entries with falsified small declared sizes and high-ratio DEFLATE payloads to exhaust memory in applications reading entries asynchronously.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AD
adm-zip · cthackers
0.6.0 before 0.6.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-114103
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-114103
github.com
https://github.com/cthackers/adm-zip/security/advisories/GHSA-c6fg-446q-cg94
www.vulncheck.com
https://www.vulncheck.com/advisories/adm-zip-0.6.0-decompression-bomb-guard-bypass-via-getdataasync
More from adm-zip
7.5
CVE-2026-114102
adm-zip before 0.6.1 Denial of Service via inflateAsync Unhandled Error Event
7.5
CVE-2026-77301
adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)
7.5
CVE-2026-92000
adm-zip 0.5.14 through 0.6.0 Denial of Service via Zero Declared Uncompressed Size
7.1
CVE-2026-102282
adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation
6.5
CVE-2026-76845
adm-zip 0.5.9 through 0.6.0 Arbitrary File Overwrite via Symlink Following on Extraction