What is the CVSS score of CVE-2026-92000?

CVE-2026-92000 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.4%.

Is there a patch available for CVE-2026-92000?

Yes, a patch is available for CVE-2026-92000. Update the affected software to the latest version immediately.

CVE-2026-92000

EUVD-2026-80001 HIGH

Improper Handling of Highly Compressed Data (Data Amplification) (CWE-409)

2026-09-15 disclosure@vulncheck.com

GHSA-ffxc-vw9f-x2cp

Denial Of Service

8.7

CVSS 4.0 · Vendor: vulncheck

View

Vulnerability Assessment

Weakness

CWE

CWE-409

ASVS 5.0

V2 - Validation and Business Logic Compression ratio limits

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 15, 2026

adm-zip 0.5.14 through 0.6.0, a widely used Node.js ZIP library, omits zlib decompression output limits whenever a ZIP entry declares an uncompressed size of zero, letting a tiny crafted archive inflate without bound and exhaust the host process memory. Any service that extracts attacker-supplied archives with an affected version — upload endpoints, import jobs, CI tooling — can be crashed by a few kilobytes of input, with no authentication or user interaction required per the CVSS 4.0 vector (PR:N/UI:N, VA:H only). No CISA KEV listing, EPSS score, or public exploit code was supplied at time of analysis, but the fix commit and diff are public and the technique is trivial to reproduce.

Affected VersionsENISA

adm-zip 0.5.14 <0.6.1

Affected Packages

npm adm-zip fix: 0.6.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (vulncheck) PRIMARY 8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Red Hat 7.5 HIGH

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

None

Vulnerable system: Integrity

None

Vulnerable system: Availability

High

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

Patch available

Sep 15, 2026 - 22:20 EUVD

CVE Published

Sep 15, 2026 - 21:16 cve.org

HIGH 8.7

DescriptionCVE.org

adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP entries declare zero uncompressed size. Attackers can craft malicious ZIP archives with highly compressible entries declaring zero size to exhaust memory and cause denial of service.

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

5,379 npm packages depend on adm-zip (820 direct, 4,594 indirect)

Ecosystem-wide dependent count for version 0.6.1.

Technical POC Analysis

Note on identifiers: the supplied advisory records CVE ID "No known CVE" and suggests CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.

Threat Intelligence Overview

EPSS Score

0.4%

Top 67% exploitable

Social Media

Sightings

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS Vendor CIRCL

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.4%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact· derived

Medium

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +44

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Same weakness CWE-409 – Improper Handling of Highly Compressed Data (Data Amplification)

View all

CVE-2026-77620 HIGH POC

8.7

CVE-2026-59803 HIGH POC

8.7

CVE-2026-53430 HIGH POC

8.7

CVE-2026-49755 HIGH POC

8.2

CVE-2026-48594 HIGH POC

8.2

CVE-2026-59939 HIGH POC

7.5

CVE-2024-7765 HIGH POC

7.5

CVE-2026-22776 HIGH POC

7.5

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Micro 5.3	Affected
SUSE Linux Enterprise Micro 5.3	Affected
SUSE Linux Enterprise Micro 5.4	Affected
SUSE Linux Enterprise Micro 5.4	Affected
SUSE Linux Enterprise Micro 5.5	Affected

References

Advisories & patches

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-92000 REF https://github.com/cthackers/adm-zip REF https://github.com/cthackers/adm-zip/blob/v0.6.0/methods/inflater.js REF https://github.com/cthackers/adm-zip/commit/491600683dacb6cb9fe0718a0eeb9cb5eb49afa6 REF https://github.com/cthackers/adm-zip/commit/8bc411184de1b5ca28138c53074fb61119994dde REF https://github.com/cthackers/adm-zip/security/advisories/GHSA-rcw4-f5rp-g42v REF https://www.vulncheck.com/advisories/adm-zip-0.5.14-through-0.6.0-denial-of-service-via-zero-declared-uncompressed-size

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back

SUSE Linux Enterprise Micro 5.5	Affected
SUSE Linux Enterprise Server 16.0	Affected
SUSE Linux Enterprise Server 16.0	Affected
SUSE Linux Enterprise Server 16.1	Affected
SUSE Linux Enterprise Server 16.1	Affected
SUSE Linux Enterprise Server for SAP applications 16.0	Affected
SUSE Linux Enterprise Server for SAP applications 16.0	Affected
SUSE Linux Enterprise Server for SAP applications 16.1	Affected
SUSE Linux Enterprise Server for SAP applications 16.1	Affected
SUSE Linux Micro 6.0	Affected
SUSE Linux Micro 6.0	Affected
SUSE Linux Micro 6.1	Affected
SUSE Linux Micro 6.1	Affected
SUSE Linux Micro 6.2	Affected
SUSE Linux Micro 6.2	Affected
openSUSE Leap 16.0	Affected
openSUSE Leap 16.0	Affected
openSUSE Leap Micro 5.5	Affected