Interpretation Conflict Affecting adm-zip package, versions *
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-ADMZIP-21707815
- published25 Oct 2026
- disclosed25 Oct 2026
- creditArjun Jain
Introduced: 25 Oct 2026
NewCVE-2026-116137 (opens in a new tab)How to fix?
There is no fixed version for adm-zip.
Overview
adm-zip is a JavaScript implementation for zip data compression for NodeJS.
Affected versions of this package are vulnerable to Interpretation Conflict via canonically equivalent ZIP entry names (e.g., ./hello.txt and hello.txt), which causes readEntries() to treat them as distinct entries while extractAllTo() resolves them to the same filesystem path. An attacker can craft a ZIP archive where getEntry() or readAsText() validates benign content from one entry while extractAllTo() subsequently writes malicious content from a duplicate entry to the same path, bypassing integrity checks.