Security vulnerabilities and automated fixes for adm zip issues
8 posts found
CVE-2026-39244 is a high-severity denial of service vulnerability in adm-zip 0.5.18 that allows attackers to crash Node.js applications through malicious ZIP files. The fix upgrades the dependency to 0.6.0 and uses npm overrides to eliminate the vulnerable version from the entire dependency tree.
CVE-2026-39244 is a high-severity Denial of Service vulnerability in the adm-zip npm package (versions prior to 0.6.0) that allows an attacker to cause excessive memory allocation by supplying a specially crafted ZIP file. The fix upgrades adm-zip from 0.5.16 to 0.6.0 and pins the version via a package.json override to ensure no transitive dependency can silently pull in the vulnerable release. Left unpatched, any Node.js application that processes user-supplied ZIP archives with adm-zip is expo
CVE-2026-39244 is a high-severity Denial of Service vulnerability in adm-zip versions prior to 0.6.0, where a specially crafted ZIP file can cause the library to allocate excessive amounts of memory, potentially crashing the Node.js process. The fix involves upgrading adm-zip from 0.5.17 to 0.6.0 in the client-side dependency tree, patching the unsafe memory allocation behavior introduced by malicious ZIP metadata. Any application that processes user-supplied ZIP files using adm-zip is directly
The cc-viewer application was vulnerable to Denial of Service attacks through the adm-zip library (version 0.5.17), which could be exploited using specially crafted ZIP files that trigger excessive memory allocation. Upgrading to adm-zip 0.6.0 resolves CVE-2026-39244 by implementing proper safeguards against ZIP bomb attacks and malicious archive structures.
CVE-2026-39244 is a high-severity Denial of Service vulnerability in the `adm-zip` npm package (versions before 0.6.0) that allows an attacker to cause excessive memory allocation by supplying a specially crafted ZIP file. The vulnerability was present in the `dsh-mneme` component of the project and was remediated by upgrading `adm-zip` from `0.5.18` to `0.6.0`. Left unpatched, this flaw could allow any user capable of uploading or supplying ZIP input to crash or severely degrade the Node.js ser
A critical denial-of-service vulnerability (CVE-2026-39244) in adm-zip 0.5.10 allowed attackers to craft malicious ZIP files that triggered excessive memory allocation, potentially crashing the Node.js process. The fix upgrades adm-zip to version 0.6.0, which includes proper memory allocation limits when parsing ZIP entries. This vulnerability was discovered in the `solarIncidenceService.js` service, where uploaded ZIP files are processed without sandboxing.
A high-severity Denial of Service vulnerability (CVE-2026-39244) was discovered in adm-zip version 0.5.16, allowing attackers to crash Node.js applications by sending specially crafted ZIP files that trigger excessive memory allocation. The fix involves upgrading to adm-zip 0.6.0, which implements proper bounds checking during ZIP file decompression.
A high-severity Denial of Service vulnerability (CVE-2026-39244) was discovered in adm-zip versions prior to 0.6.0, affecting the laliga-fantasy-app. Attackers could craft malicious ZIP files that trigger excessive memory allocation, potentially crashing the web service. The fix involved upgrading adm-zip from version 0.5.16 to 0.6.0, which includes proper memory allocation bounds checking.