CVE-2026-92000

About vulnerability

adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP entries declare zero uncompressed size. Attackers can craft malicious ZIP archives with highly compressible entries declaring zero size to exhaust memory and cause denial of service.

Affected product:

@rnef/tools , Next.js , Node.js , adk-js , adm-zip , agents-js , arcjet-js , arcjet-logger , arcjet-skills , core , create-medplum , create-module-federation , create-rock , create-sanity , create-video , dcmjs , dcmjs-codecs , dcmjs-dimse , epub-extract , epub2 , fumadocs-sanity , generative-bayesian-network , google-adk , google-adk-integrations , huggingface-transformers , kiota , livekit-agents , livekit-agents-plugin-anam , livekit-agents-plugin-anthropic , livekit-agents-plugin-assemblyai , livekit-agents-plugin-azure , livekit-agents-plugin-baseten , livekit-agents-plugin-bey , livekit-agents-plugin-cartesia , livekit-agents-plugin-deepgram , livekit-agents-plugin-did , livekit-agents-plugin-elevenlabs , livekit-agents-plugin-fishaudio , livekit-agents-plugin-google , livekit-agents-plugin-hume , livekit-agents-plugin-inworld , livekit-agents-plugin-krisp , livekit-agents-plugin-lemonslice , livekit-agents-plugin-liveavatar , livekit-agents-plugin-livekit , livekit-agents-plugin-meta , livekit-agents-plugin-minimax , livekit-agents-plugin-mistral , livekit-agents-plugin-mistralai , livekit-agents-plugin-neuphonic , livekit-agents-plugin-perplexity , livekit-agents-plugin-phonic , livekit-agents-plugin-protoface , livekit-agents-plugin-resemble , livekit-agents-plugin-rime , livekit-agents-plugin-sarvam , livekit-agents-plugin-silero , livekit-agents-plugin-soniox , livekit-agents-plugin-tavus , livekit-agents-plugin-trugen , livekit-agents-plugin-xai , manifest , mastra , mastra-cloudflare-d1 , mastra-code-sdk , mastra-deployer-netlify , mastra-deployer-vercel , mastra-factory , mastra-fastembed , mastra-langsmith , mastra-longmemeval , mastracode , medplum , medplum-agent , medplum-app , medplum-bot-layer , medplum-ccda , medplum-cdk , medplum-cli , medplum-core , medplum-definitions , medplum-dosespot-core , medplum-dosespot-react , medplum-eslint-config , medplum-fhir-router , medplum-fhirtypes , medplum-health-gorilla-core , medplum-health-gorilla-react , medplum-hl7 , medplum-mock , medplum-react , medplum-react-hooks , medplum-react-scheduling , medplum-scriptsure-react , microsoft-365-agents-toolkit , module-federation-bridge-react-webpack-plugin , module-federation-bridge-shared , module-federation-bridge-vue3 , module-federation-core , module-federation-data-prefetch , module-federation-devtools , module-federation-dts-plugin , module-federation-error-codes , module-federation-managers , module-federation-modern-js , module-federation-nextjs-mf , module-federation-retry-plugin , module-federation-rsbuild-plugin , module-federation-runtime , module-federation-runtime-core , module-federation-runtime-tools , module-federation-storybook-addon , module-federation-third-party-dts-extractor , module-federation-webpack-bundler-runtime , module-federation/core , module-federation/vite , office-addin-debugging , office-addin-dev-settings , office-addin-manifest , office-addin-scripts , onnxruntime-common , protractor , remotion , remotion-animated-emoji , remotion-animation-utils , remotion-babel-loader , remotion-browser-bundler , remotion-bundler , remotion-captions , remotion-cli , remotion-cloudrun , remotion-codemods , remotion-compositor-darwin-arm64 , remotion-compositor-darwin-x64 , remotion-compositor-linux-arm64-gnu , remotion-compositor-linux-arm64-musl , remotion-compositor-linux-x64-gnu , remotion-compositor-linux-x64-musl , remotion-compositor-win32-x64-msvc , remotion-design , remotion-effects , remotion-elevenlabs , remotion-enable-scss , remotion-eslint-config , remotion-eslint-config-flat , remotion-eslint-plugin , remotion-fonts , remotion-gif , remotion-google-fonts , remotion-gsap , remotion-install-whisper-cpp , remotion-lambda , remotion-lambda-client , remotion-layout-utils , remotion-licensing , remotion-light-leaks , remotion-lottie , remotion-mac-cursors , remotion-maptiler , remotion-mcp , remotion-media , remotion-media-parser , remotion-media-utils , remotion-motion-blur , remotion-noise , remotion-openai-whisper , remotion-paths , remotion-player , remotion-preload , remotion-promo-pages , remotion-renderer , remotion-rive , remotion-rough-notation , remotion-rounded-text-box , remotion-sdk , remotion-serverless , remotion-serverless-client , remotion-sfx , remotion-shapes , remotion-skia , remotion-starburst , remotion-streaming , remotion-studio , remotion-studio-protocol , remotion-studio-server , remotion-studio-shared , remotion-svg-3d-engine , remotion-tailwind , remotion-tailwind-v4 , remotion-three , remotion-timeline-utils , remotion-transitions , remotion-vercel , remotion-video-matting , remotion-web-renderer , remotion-webcodecs , remotion-whisper-web , remotion-whisper-webgpu , remotion-zod-types , remotion-zod-types-v3 , rock , rock-js-config , rock-js-platform-android , rock-js-platform-apple-helpers , rock-js-platform-harmony , rock-js-platform-ios , rock-js-plugin-brownfield-android , rock-js-plugin-brownfield-ios , rock-js-plugin-expo-config-plugins , rock-js-plugin-metro , rock-js-plugin-repack , rock-js-provider-github , rock-js-provider-s3 , rock-js-tools , runtime-cli , sanity , sanity-access-ui , sanity-cli , sanity-cli-build , sanity-diff , sanity-mutator , sanity-preview-url-secret , sanity-schema , sanity-types , sanity-util , sanity-vercel-protection-bypass , sanity-vision , sanity-workbench-cli , sdk-typescript , selenium , sonarqube-scanner , temporalio-worker , webdriver-manager

Affected packages:

adm-zip @ 0.5.18 (+2936 more)