CVE-2026-116137

About vulnerability

adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries() check by using canonically equivalent entry names like ‘./hello.txt’ and ‘hello.txt’. Attackers can craft ZIP archives where getEntry() or readAsText() validates benign content while extractAllTo() writes malicious content to the same path, bypassing integrity checks.

Affected product:

@fastly/wasmtime , @rnef/tools , Next.js , adk-js , adm-zip , ag-ui-adk-js , arcjet-js , axe-core-cli , beeai-framework , cassandra-driver , chromedriver , create-sanity , dcmjs , dcmjs-codecs , dcmjs-dimse , epub-extract , epub2 , fingerprint-injector , fingerprint-suite , firefox-profile-js , fumadocs-sanity , generative-bayesian-network , google-adk , google-adk-integrations , google-protobuf , got-scraping , hardhat , header-generator , huggingface-transformers , huggingface-transformers-structured-output , js-compute-runtime , kiota , livekit-agents-plugin-livekit , livekit-agents-plugin-silero , manifest , mastra-code-sdk , mastra-factory , mastra-fastembed , mastra-longmemeval , mastracode , medplum-agent , microsoft-365-agents-toolkit , modern.js , module-federation-cli , module-federation-core , module-federation-dts-plugin , module-federation-enhanced , module-federation-modern-js , module-federation-native-federation-typescript , module-federation-nextjs-mf , module-federation-rsbuild-plugin , module-federation-rspack , module-federation-storybook-addon , module-federation/core , module-federation/vite , node , nomicfoundation-hardhat-ethers , nomicfoundation-hardhat-keystore , nomicfoundation-hardhat-verify , nx , nx-module-federation , nx-react , office-addin-debugging , office-addin-dev-settings , office-addin-manifest , office-addin-scripts , onnxruntime-common , percy-cli , percy-cli-app , percy-cli-build , percy-cli-command , percy-cli-config , percy-cli-doctor , percy-cli-exec , percy-cli-snapshot , percy-cli-upload , percy-core , pnpm , pnpm-building.after-install , pnpm-cache.commands , pnpm-deps.inspection.commands , pnpm-deps.status , pnpm-engine.pm.commands , pnpm-engine.runtime.deno-resolver , pnpm-fetching.binary-fetcher , pnpm-installing.client , pnpm-installing.deps-installer , pnpm-releasing.commands , pnpm-resolving.default-resolver , pnpm-store.commands , pnpm-workspace.commands , pnpm-workspace.injected-deps-syncer , protractor , remotion-video-matting , remotion-whisper-webgpu , rock , rock-js-config , rock-js-platform-android , rock-js-platform-apple-helpers , rock-js-platform-harmony , rock-js-platform-ios , rock-js-plugin-brownfield-android , rock-js-plugin-brownfield-ios , rock-js-plugin-expo-config-plugins , rock-js-plugin-metro , rock-js-plugin-repack , rock-js-provider-github , rock-js-provider-s3 , rock-js-tools , runtime-cli , safe-global-testing-kit , sanity , sanity-blueprints , sanity-cli , sanity-cli-build , sanity-plugin-mux-input , sanity-preview-url-secret , sanity-vercel-protection-bypass , sanity-vision , sanity-workbench-cli , sauce-connect-launcher , sdk-typescript , selenium , sonarqube-scanner , temporalio-google-adk-agents , vechain-sdk-js , wdio-firefox-profile-service , webdriver-manager , whistle , wordpress-env , wordpress-scripts

Affected packages:

adm-zip @ 0.4.7 (+1362 more)