CVE-2026-114103

About vulnerability

adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the maxOutputLength guard by targeting the asynchronous getDataAsync() path in methods/inflater.js. Attackers can craft ZIP entries with falsified small declared sizes and high-ratio DEFLATE payloads to exhaust memory in applications reading entries asynchronously.

Affected product:

Next.js , Node.js , adm-zip , create-sanity , manifest , module-federation-cli , module-federation-core , module-federation-dts-plugin , module-federation-enhanced , module-federation-modern-js , module-federation-nextjs-mf , module-federation-rsbuild-plugin , module-federation-rspack , module-federation-storybook-addon , module-federation/core , module-federation/vite , runtime-cli , sanity , sanity-cli , sanity-cli-build , sanity-vision , sanity-workbench-cli

Affected packages:

adm-zip @ 0.6.0 (+156 more)