Security advisories

medium2026-09-29

adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content

GHSA-p634-w6r4-rjp2

medium2026-09-29

adm-zip: getDataAsync() bypasses the maxOutputLength size guard enforced by the synchronous getData() path

GHSA-c6fg-446q-cg94

high2026-09-29

adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)

GHSA-8238-w5pm-2374

high2026-09-29

adm-zip: Decompression-bomb protection (fix for CVE-2026-39244) can be bypassed by declaring uncompressed size as 0

GHSA-rcw4-f5rp-g42v

high2026-09-29

adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation

GHSA-j5f4-cc29-5x44 · CVE-2026-102282

high2026-09-18

adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)

GHSA-7q85-xj36-vmfc · CVE-2026-77301

medium2026-08-24

adm-zip extraction follows destination symlinks, allowing arbitrary file overwrite

GHSA-vwc7-r8mq-g2x9 · CVE-2026-76845

high2026-07-10

adm-zip: Crafted ZIP file triggers 4GB memory allocation

GHSA-xcpc-8h2w-3j85 · CVE-2026-39244