A flaw was found in adm-zip, a JavaScript library for handling ZIP archives. The `getData()` function in `zipEntry.js` allocates memory based on the declared uncompressed size in a ZIP entry's central directory without validating this value against the actual compressed data. A remote attacker can exploit this by providing a specially crafted, small ZIP file that declares a multi-gigabyte uncompressed size. This can lead to excessive memory consumption, causing applications to terminate or suffer service-wide memory exhaustion, resulting in a Denial of Service (DoS).
Last checked: 2026-09-24 21:23 UTC
Proof of concept · CISA Coordinator (Assessed 2026-09-18 17:10 UTC)
Fix evidence last checked: 2026-10-09 17:54 UTC