# adm-zip (npm) vulnerabilities 9 known vulnerabilities (6 high, 2 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 0.6.1 (Sep 11, 2026): no advisory affects it - Newest unaffected release: 0.6.1 (Sep 11, 2026), the latest release - Weekly downloads: 31.5M - Dependents: 5,064 - Releases: 44 since 0.1.1 (Feb 23, 2012) - Registry: https://www.npmjs.com/package/adm-zip - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-114104: 0.1.1 to 0.6.0 (0.6.1 is outside it) - CVE-2026-114103: 0.1.1 to 0.6.0 (0.6.1 is outside it) - CVE-2026-114102: 0.1.1 to 0.6.0 (0.6.1 is outside it) - CVE-2026-102282: 0.1.1 to 0.6.0 (0.6.1 is outside it) - CVE-2026-77301: 0.1.1 to 0.6.0 (0.6.1 is outside it) - CVE-2026-92000: 0.1.1 to 0.6.0 (0.6.1 is outside it) - CVE-2026-76845: 0.5.9 to 0.6.0 (0.6.1 is outside it) - CVE-2026-39244: 0.1.1 to 0.5.18 (0.6.0 is outside it) - CVE-2018-1002204: 0.1.1 to 0.4.10 (0.4.11 is outside it) ## Advisories (9) ### [CVE-2026-114104](https://cve.now/CVE-2026-114104): adm-zip before 0.6.1 Duplicate ZIP Entry Name Validation Bypass - Severity: High 8.2 - Published: Oct 21, 2026 - Affected: fixed in 0.6.1. - Fixed in 0.6.1 (released Sep 11, 2026, 40 days before disclosure). - The latest release, 0.6.1, is not affected. - 59% of adm-zip downloads last week were affected versions (20.2M). ### [CVE-2026-114103](https://cve.now/CVE-2026-114103): adm-zip 0.6.0 Decompression Bomb Guard Bypass via getDataAsync() - Severity: Medium 6.9 - Published: Oct 21, 2026 - Affected: fixed in 0.6.1. - Fixed in 0.6.1 (released Sep 11, 2026, 40 days before disclosure). - The latest release, 0.6.1, is not affected. - 59% of adm-zip downloads last week were affected versions (20.2M). ### [CVE-2026-114102](https://cve.now/CVE-2026-114102): adm-zip before 0.6.1 Denial of Service via inflateAsync Unhandled Error Event - Severity: High 8.7 - Published: Oct 21, 2026 - Affected: fixed in 0.6.1. - Fixed in 0.6.1 (released Sep 11, 2026, 40 days before disclosure). - The latest release, 0.6.1, is not affected. - 59% of adm-zip downloads last week were affected versions (20.2M). ### [CVE-2026-102282](https://cve.now/CVE-2026-102282): adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -\> local privilege escalation - Severity: High 7.1 - Published: Oct 5, 2026 - Affected: fixed in 0.6.1. - Fixed in 0.6.1 (released Sep 11, 2026, 24 days before disclosure). - The latest release, 0.6.1, is not affected. - 59% of adm-zip downloads last week were affected versions (20.2M). ### [CVE-2026-77301](https://cve.now/CVE-2026-77301): adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS) - Severity: High 7.5 - Published: Sep 18, 2026 - Affected: fixed in 0.6.1. - Fixed in 0.6.1 (released Sep 11, 2026, 7 days before disclosure). - The latest release, 0.6.1, is not affected. - 59% of adm-zip downloads last week were affected versions (20.2M). ### [CVE-2026-92000](https://cve.now/CVE-2026-92000): adm-zip 0.5.14 through 0.6.0 Denial of Service via Zero Declared Uncompressed Size - Severity: High 8.7 - Published: Sep 15, 2026 - Affected: fixed in 0.6.1. - Fixed in 0.6.1 (released Sep 11, 2026, 4 days before disclosure). - The latest release, 0.6.1, is not affected. - 59% of adm-zip downloads last week were affected versions (20.2M). ### [CVE-2026-76845](https://cve.now/CVE-2026-76845): adm-zip 0.5.9 through 0.6.0 Arbitrary File Overwrite via Symlink Following on Extraction - Severity: Medium 6.8 - Published: Aug 24, 2026 - Affected: from 0.5.9, through 0.6.0; from 0.5.9, through 0.6.0. - Fixed in 0.6.1 (released Sep 11, 2026, 18 days after disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 0.6.1, is not affected. - 55% of adm-zip downloads last week were affected versions (18.9M). ### [CVE-2026-39244](https://cve.now/CVE-2026-39244): adm-zip before 0.5.18 is vulnerable to denial of service via a crafted ZIP file with a manipulated uncompressed size header field. - Severity: High 7.5 - Published: Jul 10, 2026 - Affected: fixed in 0.6.0. - Fixed in 0.6.0 (released Jul 10, 2026, the day of disclosure). - The latest release, 0.6.1, is not affected. - 51% of adm-zip downloads last week were affected versions (17.5M). ### [CVE-2018-1002204](https://cve.now/CVE-2018-1002204): adm-zip npm library before 0.4.9 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot… - Severity: Unrated - Published: Jul 25, 2018 - Affected: fixed in 0.4.11. - Fixed in 0.4.11 (released May 12, 2018, 74 days before disclosure). - The latest release, 0.6.1, is not affected. - 0.5% of adm-zip downloads last week were affected versions (156.6K). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/adm-zip Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.