adm-zip EUVD-2026-106905

Exploitation requires that the target application call one of adm-zip's asynchronous decompression APIs - readFileAsync, readAsTextAsync, extractAllToAsync, or ZipEntry.getDataAsync - on an attacker-supplied ZIP file, on a vulnerable version (<= 0.6.0). The specific triggering condition is any DEFLATE-compressed entry whose bytes are corrupted (producing Z_DATA_ERROR) or whose inflated size exceeds the declared central-directory size (tripping the maxOutputLength guard), because inflateAsync in methods/inflater.js registers no 'error' listener on the zlib.createInflateRaw stream. LIMITING FACTORS: the synchronous decompression APIs are NOT affected (their throws are catchable, per the earlier CVE-2026-39244 fix), so applications using only sync methods are not exposed; exploitation is confined to availability (process crash) with no data exposure or code execution, and the application must actually process untrusted ZIP input through the async path.

This is a genuinely high-priority availability issue for exposed deployments, though its real-world impact is narrower than the 8.7 CVSS 4.0 score suggests in isolation. The vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) confirms remote, unauthenticated, low-complexity exploitation with no user interaction and high availability impact but zero confidentiality or integrity impact - consistent with CWE-248 (uncaught exception). The severity is real because a single malformed ZIP crashes the entire Node.js process, terminating all in-flight requests, and the crash is uncatchable by try/catch (the error surfaces asynchronously from the zlib C++ binding on a later tick). However, no EPSS score, KEV listing, or explicit public exploit code is present in the provided data, so there is no evidence of active exploitation - this is a prioritize-and-patch issue, not an emergency incident response. The GHSA advisory notes the trigger requires 'no special crafting' (any corrupted DEFLATE stream suffices), which raises practical likelihood for any service that ingests untrusted ZIPs. Net: the high score is justified for impact and ease, but exploitation signals are absent and the blast radius is scoped to availability only.

An attacker uploads or submits a single ZIP file containing a DEFLATE entry with corrupted compressed bytes to a web service that processes it via adm-zip's async API (e.g., readFileAsync or extractAllToAsync). When the stream emits a Z_DATA_ERROR with no error listener attached, Node.js rethrows it as an uncaught exception on a later tick, crashing the whole process and dropping every concurrent request. No authentication, user interaction, or exploit tooling is required; the advisory confirms no special crafting is needed, though no packaged public PoC is cited in the provided data.