Is adm-zip 0.2 vulnerable?

npm · 2 releases from 0.2.0 to 0.2.1 · latest adm-zip is 0.6.1 · checked 1 Nov 2026

Yes: 8 known advisories

Yes. adm-zip 0.2.1, the last 0.2 release, is affected by 8 known security advisories (5 high, 3 medium), including CVE-2026-114102, CVE-2026-92000, CVE-2026-102282. Upgrade to 0.6.1 or later to fix all of them.

Upgrade with:npm install adm-zip@0.6.1

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Advisories affecting adm-zip 0.2.1

  • MediumCVE-2026-114104GHSA-p634-w6r4-rjp229 Sept 2026

    adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content

    Affected
    <0.6.1
    Fixed in
    0.6.1
  • MediumCVE-2026-114103GHSA-c6fg-446q-cg9429 Sept 2026

    adm-zip: getDataAsync() bypasses the maxOutputLength size guard enforced by the synchronous getData() path

    Affected
    <0.6.1
    Fixed in
    0.6.1
  • HighCVE-2026-114102GHSA-8238-w5pm-237429 Sept 2026

    adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)

    Affected
    <0.6.1
    Fixed in
    0.6.1
  • HighCVE-2026-92000GHSA-rcw4-f5rp-g42v29 Sept 2026

    adm-zip: Decompression-bomb protection (fix for CVE-2026-39244) can be bypassed by declaring uncompressed size as 0

    Affected
    <0.6.1
    Fixed in
    0.6.1
  • HighCVE-2026-102282GHSA-j5f4-cc29-5x4429 Sept 2026

    adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation

    Affected
    <0.6.1
    Fixed in
    0.6.1
  • HighCVE-2026-77301GHSA-7q85-xj36-vmfc18 Sept 2026

    adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)

    Affected
    <0.6.1
    Fixed in
    0.6.1
  • HighCVE-2026-39244GHSA-xcpc-8h2w-3j8510 Jul 2026

    adm-zip: Crafted ZIP file triggers 4GB memory allocation

    Affected
    <0.6.0
    Fixed in
    0.6.0
  • MediumCVE-2018-1002204GHSA-3v6h-hqm4-2rg627 Jul 2018

    Arbitrary File Write in adm-zip

    Affected
    <0.4.11
    Fixed in
    0.4.11

Which of your client projects are still on adm-zip 0.2?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact adm-zip version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other adm-zip versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.