adm-zip vulnerabilities
Javascript implementation of zip for nodejs with support for electron original-fs. Allows user to create or extract zip files both in memory or to/from disk
- Registry
- npm
- Latest
- 0.6.1
- License
- MIT
9 known advisories
The latest version, 0.6.1, is not affected by any of them. Projects on older versions may be.
npm install adm-zip@0.6.1Security advisories for adm-zip
adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content
- Affected
- <0.6.1
- Fixed in
- 0.6.1
adm-zip: getDataAsync() bypasses the maxOutputLength size guard enforced by the synchronous getData() path
- Affected
- <0.6.1
- Fixed in
- 0.6.1
adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)
- Affected
- <0.6.1
- Fixed in
- 0.6.1
adm-zip: Decompression-bomb protection (fix for CVE-2026-39244) can be bypassed by declaring uncompressed size as 0
- Affected
- <0.6.1
- Fixed in
- 0.6.1
adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation
- Affected
- <0.6.1
- Fixed in
- 0.6.1
adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)
- Affected
- <0.6.1
- Fixed in
- 0.6.1
adm-zip extraction follows destination symlinks, allowing arbitrary file overwrite
- Affected
- >=0.5.9 <=0.6.0
- Fixed in
- No fix released
adm-zip: Crafted ZIP file triggers 4GB memory allocation
- Affected
- <0.6.0
- Fixed in
- 0.6.0
Arbitrary File Write in adm-zip
- Affected
- <0.4.11
- Fixed in
- 0.4.11
Which of your client projects still run an old adm-zip?
NPMscan reads the package-lock.json, yarn.lock and pnpm-lock.yaml in every GitHub repo you pick and checks each installed version against these advisories, including the packages your packages pull in. Each finding comes with the command that fixes it.
Other npm packages
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily. Package details from the npm registry.