CVE-2026-77301 adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)
Attackers can cause memory exhaustion and service termination by providing crafted ZIP archives with inflated uncompressed size declarations to applications using adm-zip.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-77301?
CVE-2026-77301 is a high-severity denial of service vulnerability in cthackers adm-zip, published on 18 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, getData() in zipEntry.js trusts an entry's central-directory uncompressed size and allocates output memory before validating that value against the actual compressed data and decompression result. A small crafted ZIP can declare a multi-gigabyte uncompressed size, causing Buffer.alloc and decompression handling to commit excessive resident memory before CRC validation reports an error. Applications that read entries from untrusted archives can therefore be terminated by the operating system or suffer service-wide memory exhaustion. This issue is fixed in version 0.6.1.
Weakness: CWE-789
Which versions are affected by CVE-2026-77301?
2 open source packages ship an affected version, including adm-zip.
| Package | Affected | Fixed in |
|---|---|---|
adm-zip npm | All versions | 0.6.1 |
adm-zip npm | All versions | 0.6.1 |
How do I fix CVE-2026-77301?
Upgrade adm-zip to 0.6.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-77301 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-77301 exists.
Sources
Also known as CLEANSTART-2026-BF81327, CLEANSTART-2026-PG50954, CLSA-2026-1790162622, CLSA-2026-1790166345, CLSA-2026-1790180021, CLSA-2026-1791626782 and 17 more.