adm-zip ZIP Processing Vulnerabilities

Denial of service in adm-zip 0.6.0 and earlier lets remote attackers terminate the entire Node.js host process by submitting a single malformed ZIP file to any of the library's asynchronous decompression APIs. The flaw sits in inflateAsync (methods/inflater.js), which pipes attacker-controlled DEFLATE bytes into a zlib.createInflateRaw stream without registering an 'error' listener, so a corrupted stream or an over-large inflation surfaces as an uncatchable uncaught exception that kills the process and every in-flight request with it. Only applications that call readFileAsync, readAsTextAsync, extractAllToAsync, or ZipEntry.getDataAsync on untrusted input on versions <= 0.6.0 are exposed; the synchronous APIs are unaffected, and there is no data disclosure or code execution - impact is availability only. No public exploit code was identified at the time of analysis, and the issue is not listed in CISA KEV.

Integrity bypass in adm-zip through 0.6.0 allows an unauthenticated attacker who supplies a crafted ZIP to a validate-then-extract application to have getEntry() approve one duplicate entry while extractAllTo() writes a different entry's bytes to disk. The flaw is conditional: the consuming application must inspect a named entry's content via getEntry() and then extract the same archive, and the archive must contain duplicate entry names with the relevant ordering; applications that only extract without a getEntry-based content check are not affected. Public proof-of-concept code is present in the upstream advisory, and no CISA KEV active-exploitation listing is associated with this CVE.

adm-zip versions before 0.6.1 can apply attacker-controlled setuid, setgid, or sticky bits when extracting archives with the non-default keepOriginalPermission option enabled. This is a conditional local privilege-escalation risk: the archive must be extracted in a privileged context such as root and the resulting executable must later be run, so exploitation depends on that specific workflow. No public exploit identified at time of analysis, and the vendor-released patch is adm-zip 0.6.1.

Memory exhaustion in adm-zip 0.6.0 and earlier allows unauthenticated remote attackers to bypass the library's decompression-bomb guard on the asynchronous getDataAsync() path, causing the full decompressed payload to be allocated regardless of an entry's declared uncompressed size. This is a genuine but bounded availability issue: only Node.js applications that read ZIP entries asynchronously and rely on the declared size as their bomb protection are exposed, there is no confidentiality or integrity impact, and meaningful denial of service typically requires repeated or large crafted submissions. Publicly available exploit code exists in the form of a working proof-of-concept published with the GitHub advisory, and the flaw is fixed in adm-zip 0.6.1.