EUVD-2026-80001
GHSA-ffxc-vw9f-x2cp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (vulncheck) · only source for this CVE.
CVSS VectorVendor: vulncheck
Lifecycle Timeline
5DescriptionCVE.org
adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP entries declare zero uncompressed size. Attackers can craft malicious ZIP archives with highly compressible entries declaring zero size to exhaust memory and cause denial of service.
AnalysisAI
adm-zip 0.5.14 through 0.6.0, a widely used Node.js ZIP library, omits zlib decompression output limits whenever a ZIP entry declares an uncompressed size of zero, letting a tiny crafted archive inflate without bound and exhaust the host process memory. Any service that extracts attacker-supplied archives with an affected version — upload endpoints, import jobs, CI tooling — can be crashed by a few kilobytes of input, with no authentication or user interaction required per the CVSS 4.0 vector (PR:N/UI:N, VA:H only). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today