CVE-2026-92000

HIGH 7.5

adm-zip 0.5.14 through 0.6.0 Denial of Service via Zero Declared Uncompressed Size

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP entries declare zero uncompressed size. Attackers can craft malicious ZIP archives with highly compressible entries declaring zero size to exhaust memory and cause denial of service.

CWE	CWE-409
Vendor	cthackers
Product	adm-zip
Published	Sep 15, 2026

Stay Ahead of the Next One

Get instant alerts for cthackers adm-zip

Be the first to know when new high vulnerabilities affecting cthackers adm-zip are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

cthackers / adm-zip

0.5.14 < 0.6.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/cthackers/adm-zip/security/advisories/GHSA-rcw4-f5rp-g42v github.com: https://github.com/cthackers/adm-zip/commit/491600683dacb6cb9fe0718a0eeb9cb5eb49afa6 github.com: https://github.com/cthackers/adm-zip/commit/8bc411184de1b5ca28138c53074fb61119994dde github.com: https://github.com/cthackers/adm-zip/blob/v0.6.0/methods/inflater.js github.com: https://github.com/cthackers/adm-zip vulncheck.com: https://www.vulncheck.com/advisories/adm-zip-0.5.14-through-0.6.0-denial-of-service-via-zero-declared-uncompressed-size

Credits

🔍 Dilipkumar Choudhary