Allocation of Resources Without Limits or Throttling Affecting adm-zip package, versions <0.6.1
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Allocation of Resources Without Limits or Throttling vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-JS-ADMZIP-20335421
- published30 Sept 2026
- disclosed29 Sept 2026
- creditEzinne Kalu
Introduced: 29 Sep 2026
New CVE NOT AVAILABLE CWE-770 (opens in a new tab)How to fix?
Upgrade adm-zip to version 0.6.1 or higher.
Overview
adm-zip is a JavaScript implementation for zip data compression for NodeJS.
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the async decompression path in methods/inflater.js, where the maxOutputLength cap enforced by zlib's sync API is not applied to the streaming (async) path. An attacker can supply a ZIP entry whose declared uncompressed size is small but whose compressed payload expands arbitrarily, causing unbounded memory growth and crashing the host process.