CVE-2026-114102 adm-zip before 0.6.1 Denial of Service via inflateAsync Unhandled Error Event
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-114102?
CVE-2026-114102 is a high-severity vulnerability in cthackers adm-zip, published on 21 Oct 2026.
Official description
adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.js process via a malformed ZIP file, because inflateAsync in methods/inflater.js lacks a zlib stream error listener. Attackers can supply a ZIP with corrupted DEFLATE data processed by readFileAsync, readAsTextAsync, extractAllToAsync, or getDataAsync, triggering an uncatchable exception that terminates all in-flight requests.
Weakness: CWE-248
Which versions are affected by CVE-2026-114102?
2 open source packages ship an affected version, including adm-zip.
| Package | Affected | Fixed in |
|---|---|---|
adm-zip npm | All versions | 0.6.1 |
adm-zip npm | All versions | 0.6.1 |
How do I fix CVE-2026-114102?
Upgrade adm-zip to 0.6.1 or later.
Is CVE-2026-114102 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-114102 exists.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as CLEANSTART-2026-IF17943, CLSA-2026-1791627044, ECHO-c388-a2f8-a3cc, GHSA-8238-w5pm-2374, GHSA-f9g8-qp78-x5c2, MINI-2gpx-39wc-7m56 and 14 more.