CVE-2026-114103 adm-zip 0.6.0 Decompression Bomb Guard Bypass via getDataAsync()
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-114103?
CVE-2026-114103 is a medium-severity vulnerability in cthackers adm-zip, published on 21 Oct 2026.
Official description
adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the maxOutputLength guard by targeting the asynchronous getDataAsync() path in methods/inflater.js. Attackers can craft ZIP entries with falsified small declared sizes and high-ratio DEFLATE payloads to exhaust memory in applications reading entries asynchronously.
Weakness: CWE-400
Which versions are affected by CVE-2026-114103?
2 open source packages ship an affected version, including adm-zip.
| Package | Affected | Fixed in |
|---|---|---|
adm-zip npm | All versions | 0.6.1 |
adm-zip npm | All versions | 0.6.1 |
How do I fix CVE-2026-114103?
Upgrade adm-zip to 0.6.1 or later.
Is CVE-2026-114103 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-114103 exists.
Sources
Also known as CLEANSTART-2026-FU01230, ECHO-2ab8-f491-d1d7, GHSA-c6fg-446q-cg94, GHSA-x5pg-q574-6h2m, MINI-2r7j-vx6f-pqxr, MINI-4493-xg2f-2q39 and 12 more.