Is adm-zip 0.6 vulnerable?

npm · 2 releases from 0.6.0 to 0.6.1 · latest adm-zip is 0.6.1 · checked 1 Nov 2026

No known advisories in the last release

adm-zip 0.6.1, the last 0.6 release, has no known advisories. 7 advisories affect earlier 0.6.x releases, so update to 0.6.1.

Update within 0.6:npm install adm-zip@0.6.1

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Fixed within 0.6.x, affecting earlier releases

  • MediumCVE-2026-114104GHSA-p634-w6r4-rjp229 Sept 2026

    adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content

    Affected
    <0.6.1
    Fixed in
    0.6.1
  • MediumCVE-2026-114103GHSA-c6fg-446q-cg9429 Sept 2026

    adm-zip: getDataAsync() bypasses the maxOutputLength size guard enforced by the synchronous getData() path

    Affected
    <0.6.1
    Fixed in
    0.6.1
  • HighCVE-2026-114102GHSA-8238-w5pm-237429 Sept 2026

    adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)

    Affected
    <0.6.1
    Fixed in
    0.6.1
  • HighCVE-2026-92000GHSA-rcw4-f5rp-g42v29 Sept 2026

    adm-zip: Decompression-bomb protection (fix for CVE-2026-39244) can be bypassed by declaring uncompressed size as 0

    Affected
    <0.6.1
    Fixed in
    0.6.1
  • HighCVE-2026-102282GHSA-j5f4-cc29-5x4429 Sept 2026

    adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation

    Affected
    <0.6.1
    Fixed in
    0.6.1
  • HighCVE-2026-77301GHSA-7q85-xj36-vmfc18 Sept 2026

    adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)

    Affected
    <0.6.1
    Fixed in
    0.6.1
  • MediumCVE-2026-76845GHSA-vwc7-r8mq-g2x924 Aug 2026

    adm-zip extraction follows destination symlinks, allowing arbitrary file overwrite

    Affected
    >=0.5.9 <=0.6.0
    Fixed in
    No fix released

Which of your client projects are still on adm-zip 0.6?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact adm-zip version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other adm-zip versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.