Skip to content
OpenAdvisories

Package · npm

adm-zip

9 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.5
    CVE-2026-114102 Public exploit

    adm-zip before 0.6.1 Denial of Service via inflateAsync Unhandled Error Event

    adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.js process via a malformed ZIP file, because inflateAsync in methods/inflater.js lacks a zlib stream error listener. Attackers can supply a…

    cthackers adm-zip adm-zip npm
  • High 7.1
    CVE-2026-102282 Public exploit

    adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation

    adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via `fs.chmodSync()` when `keepOriginalPermission=true` is passe…

    cthackers adm-zip adm-zip npm