Is adm-zip 0.5 vulnerable?

npm · 19 releases from 0.5.0 to 0.5.18 · latest adm-zip is 0.6.1 · checked 1 Nov 2026

Yes: 8 known advisories

Yes. adm-zip 0.5.18, the last 0.5 release, is affected by 8 known security advisories (5 high, 3 medium), including CVE-2026-114102, CVE-2026-92000, CVE-2026-102282. At least one has no fixed release yet.

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Advisories affecting adm-zip 0.5.18

  • MediumCVE-2026-114104GHSA-p634-w6r4-rjp229 Sept 2026

    adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content

    Affected
    <0.6.1
    Fixed in
    0.6.1
  • MediumCVE-2026-114103GHSA-c6fg-446q-cg9429 Sept 2026

    adm-zip: getDataAsync() bypasses the maxOutputLength size guard enforced by the synchronous getData() path

    Affected
    <0.6.1
    Fixed in
    0.6.1
  • HighCVE-2026-114102GHSA-8238-w5pm-237429 Sept 2026

    adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)

    Affected
    <0.6.1
    Fixed in
    0.6.1
  • HighCVE-2026-92000GHSA-rcw4-f5rp-g42v29 Sept 2026

    adm-zip: Decompression-bomb protection (fix for CVE-2026-39244) can be bypassed by declaring uncompressed size as 0

    Affected
    <0.6.1
    Fixed in
    0.6.1
  • HighCVE-2026-102282GHSA-j5f4-cc29-5x4429 Sept 2026

    adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation

    Affected
    <0.6.1
    Fixed in
    0.6.1
  • HighCVE-2026-77301GHSA-7q85-xj36-vmfc18 Sept 2026

    adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)

    Affected
    <0.6.1
    Fixed in
    0.6.1
  • MediumCVE-2026-76845GHSA-vwc7-r8mq-g2x924 Aug 2026

    adm-zip extraction follows destination symlinks, allowing arbitrary file overwrite

    Affected
    >=0.5.9 <=0.6.0
    Fixed in
    No fix released
  • HighCVE-2026-39244GHSA-xcpc-8h2w-3j8510 Jul 2026

    adm-zip: Crafted ZIP file triggers 4GB memory allocation

    Affected
    <0.6.0
    Fixed in
    0.6.0

Which of your client projects are still on adm-zip 0.5?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact adm-zip version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other adm-zip versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.