CVE-2026-92000

adm-zip, a widely used Node.js ZIP-handling library, fails to apply zlib decompression output limits when a ZIP entry declares an uncompressed size of zero. An attacker can exploit this by supplying a crafted archive containing highly compressible entries (a classic zip bomb) that expand without bound in memory when decompressed, exhausting RAM and crashing or hanging the process. The impact is availability only — CVSS 4.0 scores it 8.7 with no confidentiality or integrity impact — and it is remotely triggerable with no privileges or user interaction where the application processes untrusted archives. Affected deployments are any services or tooling built on adm-zip 0.5.14 through 0.6.0 that decompress user-supplied ZIP files, such as file-upload handlers, document-import pipelines, and build tooling. There is no known public proof of concept, the flaw is not in CISA's KEV catalog, and no exploitation in the wild has been reported.

What to do: Upgrade adm-zip to a release outside the affected 0.5.14–0.6.0 range — check npm for the latest version and update the direct dependency or the transitive dependency in your lockfile. Until patched, reject or quarantine ZIP entries that declare a zero uncompressed size and enforce hard caps on total decompressed bytes, decompression rate, and concurrent archive processing, with memory limits on the Node.js process. Audit whether any internet-facing feature accepts and decompresses user-uploaded ZIP archives, since those face unauthenticated remote denial of service.