12 New Node.js Vulnerabilities - 12 High Severity, No Public POC

Integrity bypass in adm-zip through 0.6.0 allows an unauthenticated attacker who supplies a crafted ZIP to a validate-then-extract application to have getEntry() approve one duplicate entry while extractAllTo() writes a different entry's bytes to disk. The flaw is conditional: the consuming application must inspect a named entry's content via getEntry() and then extract the same archive, and the archive must contain duplicate entry names with the relevant ordering; applications that only extract without a getEntry-based content check are not affected. Public proof-of-concept code is present in the upstream advisory, and no CISA KEV active-exploitation listing is associated with this CVE.

adm-zip versions before 0.6.1 can apply attacker-controlled setuid, setgid, or sticky bits when extracting archives with the non-default keepOriginalPermission option enabled. This is a conditional local privilege-escalation risk: the archive must be extracted in a privileged context such as root and the resulting executable must later be run, so exploitation depends on that specific workflow. No public exploit identified at time of analysis, and the vendor-released patch is adm-zip 0.6.1.

Memory exhaustion in adm-zip 0.6.0 and earlier allows unauthenticated remote attackers to bypass the library's decompression-bomb guard on the asynchronous getDataAsync() path, causing the full decompressed payload to be allocated regardless of an entry's declared uncompressed size. This is a genuine but bounded availability issue: only Node.js applications that read ZIP entries asynchronously and rely on the declared size as their bomb protection are exposed, there is no confidentiality or integrity impact, and meaningful denial of service typically requires repeated or large crafted submissions. Publicly available exploit code exists in the form of a working proof-of-concept published with the GitHub advisory, and the flaw is fixed in adm-zip 0.6.1.