CVE-2026-77301

adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, getData() in zipEntry.js trusts an entry's central-directory uncompressed size and allocates output memory before validating that value against the actual compressed data and decompression result. A small crafted ZIP can declare a multi-gigabyte uncompressed size, causing Buffer.alloc and decompression handling to commit excessive resident memory before CRC validation reports an error. Applications that read entries from untrusted archives can therefore be terminated by the operating system or suffer service-wide memory exhaustion. This issue is fixed in version 0.6.1.

• CWE-789

• https://github.com/cthackers/adm-zip/commit/491600683dacb6cb9fe0718a0eeb9cb5eb49afa6
• https://github.com/cthackers/adm-zip/releases/tag/v0.6.1
• https://github.com/cthackers/adm-zip/security/advisories/GHSA-7q85-xj36-vmfc
• https://github.com/cthackers/adm-zip/security/advisories/GHSA-7q85-xj36-vmfc

Published

Sep 18, 2026

Last Modified

Sep 18, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-77274MCP Atlassian is a Model Context Protocol (MCP) server for A…8.8
• CVE-2026-7728A vulnerability was identified in ryanjoachim mcp-rtfm 0.1.0…6.3
• CVE-2026-77281Caddy is an extensible server platform that uses TLS by defa…6.5
• CVE-2026-7729A security flaw has been discovered in pixelsock directus-mc…6.3
• CVE-2026-77298SeaweedFS is a distributed storage system for files and blob…8.7
• CVE-2026-7730A weakness has been identified in privsim mcp-test-runner 0.…6.3
• CVE-2026-7731A security vulnerability has been detected in code-projects …6.3
• CVE-2026-77310jackson-databind contains the general-purpose data-binding f…5.3
• CVE-2026-77317SeaweedFS is a distributed storage system for files and blob…8.1
• CVE-2026-7732A vulnerability was detected in code-projects BloodBank Mana…6.3
• CVE-2026-77322SIPGO is a library for writing SIP services in the GO langua…7.5
• CVE-2026-7733A flaw has been found in funadmin up to 7.1.0-rc6. This affe…7.3