CVE-2026-77301

The record

adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, getData() in zipEntry.js trusts an entry's central-directory uncompressed size and allocates output memory before validating that value against the actual compressed data and decompression result. A small crafted ZIP can declare a multi-gigabyte uncompressed size, causing Buffer.alloc and decompression handling to commit excessive resident memory before CRC validation reports an error. Applications that read entries from untrusted archives can therefore be terminated by the operating system or suffer service-wide memory exhaustion. This issue is fixed in version 0.6.1.

Affected packages

Related vulnerabilities

• CVE-2026-77410 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. CWE-789
• CVE-2026-53716 Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or… CWE-789
• CVE-2026-53717 Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or… CWE-789
• CVE-2026-77354 kin-openapi is a Go project for handling OpenAPI files. CWE-789
• CVE-2026-69219 The RabbitMQ Java client library allows Java and JVM-based applications to connect to and… CWE-789
• CVE-2026-66485 GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at… CWE-789
• CVE-2026-59844 A flaw was found in libssh. CWE-789
• CVE-2026-40378 Memory allocation with excessive size value in Windows Local Security Authority Subsystem… CWE-789