CVE-2026-39244: adm-zip Denial of Service via Malicious ZIP Memory Exhaustion

Technical summary

The vulnerability exists in adm-zip's zipEntry.js (line 103) and entryHeader.js (line 266) where the uncompressed size field from the ZIP central directory header is read and passed directly to Buffer.alloc() without bounds validation. The CWE-400 (Uncontrolled Resource Consumption) flaw allows an attacker to construct a ZIP archive with a drastically inflated size declaration. Since memory allocation happens before CRC validation, malicious files cannot be rejected through integrity checks. The attack affects all entry points: readFile(), readAsText(), extractEntryTo(), extractAllTo(), extractAllToAsync(), test(), and entry.getData(). The amplification ratio—over 33 million to 1 between declared and actual size—makes this a highly efficient denial-of-service vector.

Business impact

Any application or service using adm-zip to process untrusted ZIP files becomes vulnerable to immediate denial of service. File processing services, document handlers, backup utilities, and deployment tools that accept user-uploaded or network-sourced archives can crash upon encountering a malicious file. This impacts availability; attackers need no authentication or interaction beyond file submission. In high-volume scenarios (API endpoints, batch processors), a single request with a crafted ZIP can terminate the worker process, potentially affecting multiple transactions or users.

Affected systems

adm-zip versions prior to 0.5.18 are vulnerable. Any Node.js application directly using adm-zip—or indirectly through a dependency—for ZIP file operations is at risk. This includes web servers, CLI tools, build systems, archive managers, and file synchronization utilities. The vulnerability requires no special configuration; simply importing and using any read or extraction method on untrusted ZIP data is sufficient to trigger the issue.

Exploitability

Exploitation requires only network or file-system access to supply a crafted ZIP file to a vulnerable application. No authentication, user interaction, or complex techniques are necessary. The attack surface is broad: any endpoint accepting file uploads, API accepting binary data, or command-line tool processing archives is exploitable. The low complexity and lack of prerequisites (CVSS AC:L, PR:N, UI:N) make this straightforward to weaponize. However, practical impact depends on whether the application re-spawns crashed workers or has redundancy.

Remediation

Upgrade adm-zip to version 0.5.18 or later. This update adds bounds checking to the uncompressed size field, preventing memory allocation amplification attacks. Verify the upgrade in your package.json or lock file (package-lock.json / yarn.lock) after running npm update or yarn upgrade. For applications unable to update immediately, implement application-level safeguards: reject ZIP files exceeding a reasonable size threshold before passing them to adm-zip, or run ZIP processing in isolated, resource-constrained child processes that can be safely terminated.

Patch guidance

Update your adm-zip dependency to version 0.5.18 or higher. In npm environments: run 'npm install adm-zip@latest' or edit package.json to require '^0.5.18' and reinstall. In yarn: 'yarn upgrade adm-zip'. After updating, rebuild and redeploy your application. If you maintain applications that bundle adm-zip, ensure all downstream packages also receive the updated version. Verify the fix by checking that adm-zip in node_modules reflects the corrected version. Consider adding a pre-deployment test that attempts to process a known malicious ZIP (available in the CVE test suite) to confirm the fix blocks the attack.

Detection guidance

Monitor for unusual memory consumption spikes or out-of-memory exceptions in processes running adm-zip. Log file submission sizes and compare against decompressed sizes reported by the library; anomalous ratios suggest attempted exploitation. Watch for repeated process crashes following file uploads or archive processing requests. In containerized environments, track memory limits being hit unexpectedly. Implement dependency scanning in your CI/CD pipeline (npm audit, Snyk, Dependabot) to flag adm-zip versions below 0.5.18 before code reaches production. If you have sample malicious ZIPs, you may test them against current versions to verify vulnerability or patch status.

Why prioritize this

This vulnerability warrants immediate attention despite a single-application scope. The HIGH severity (CVSS 7.5) reflects straightforward exploitability, complete availability impact, and network accessibility. The amplification ratio and broad API surface (seven different entry points) mean multiple code paths can trigger the crash. Organizations running file-processing services, especially those exposed to the internet or untrusted users, should prioritize patching. The fix is simple (version bump), and no workaround is as robust as upgrading.

Risk score, explained

CVSS 3.1 score of 7.5 (HIGH) reflects: Attack Vector Network (AV:N)—the file can originate remotely; Attack Complexity Low (AC:L)—no special conditions required; Privileges Required None (PR:N) and User Interaction None (UI:N)—no authentication or user action needed; Confidentiality None (C:N) and Integrity None (I:N)—no data breach or corruption; Availability High (A:H)—reliable, complete process termination. The score does not account for widespread mitigation (containerization, worker processes) or limited scope, but reflects the inherent severity of the flaw itself.

Frequently asked questions