CVE-2026-114102

About vulnerability

adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.js process via a malformed ZIP file, because inflateAsync in methods/inflater.js lacks a zlib stream error listener. Attackers can supply a ZIP with corrupted DEFLATE data processed by readFileAsync, readAsTextAsync, extractAllToAsync, or getDataAsync, triggering an uncatchable exception that terminates all in-flight requests.

Affected product:

@rnef/tools , Next.js , Node.js , adk-js , adm-zip , arcjet-js , create-sanity , dcmjs , dcmjs-codecs , dcmjs-dimse , epub-extract , epub2 , fumadocs-sanity , generative-bayesian-network , google-adk , google-adk-integrations , hardhat , huggingface-transformers , kiota , livekit-agents-plugin-livekit , livekit-agents-plugin-silero , manifest , mastra-code-sdk , mastra-factory , mastra-fastembed , mastra-longmemeval , mastracode , medplum-agent , microsoft-365-agents-toolkit , module-federation-cli , module-federation-core , module-federation-dts-plugin , module-federation-enhanced , module-federation-modern-js , module-federation-nextjs-mf , module-federation-rsbuild-plugin , module-federation-rspack , module-federation-storybook-addon , module-federation/core , module-federation/vite , nomicfoundation-hardhat-ethers , office-addin-debugging , office-addin-dev-settings , office-addin-manifest , office-addin-scripts , onnxruntime-common , protractor , remotion-video-matting , remotion-whisper-webgpu , rock , rock-js-config , rock-js-platform-android , rock-js-platform-apple-helpers , rock-js-platform-harmony , rock-js-platform-ios , rock-js-plugin-brownfield-android , rock-js-plugin-brownfield-ios , rock-js-plugin-expo-config-plugins , rock-js-plugin-metro , rock-js-plugin-repack , rock-js-provider-github , rock-js-provider-s3 , rock-js-tools , runtime-cli , safe-global-testing-kit , sanity , sanity-cli , sanity-cli-build , sanity-preview-url-secret , sanity-vercel-protection-bypass , sanity-vision , sanity-workbench-cli , sauce-connect-launcher , sdk-typescript , selenium , sonarqube-scanner , temporalio-google-adk-agents , vechain-sdk-js , webdriver-manager

Affected packages:

adm-zip @ 0.4.7 (+755 more)