adm-zip Uncaught Exception Crashes Node.js on Malformed ZIP
A missing error handler in adm-zip before 0.6.1 allows unauthenticated attackers to crash Node.js processes via corrupted DEFLATE data, rated High severity.
Key points
- CVE-2026-114102 affects adm-zip versions prior to 0.6.1
- Uncaught exceptions in inflateAsync terminate Node.js processes
- Attackers exploit readFileAsync, extractAllToAsync, and other async methods
The adm-zip library for Node.js contains a denial-of-service vulnerability that crashes host processes when handling malformed ZIP archives. The flaw, tracked as CVE-2026-114102, stems from incomplete error handling in the inflation routine. Applications using adm-zip before version 0.6.1 are exposed to this risk if they process user-supplied or untrusted compressed files.
Root cause
The vulnerability arises because the inflateAsync method in methods/inflater.js lacks a zlib stream error listener. When the library encounters corrupted DEFLATE data, the underlying stream emits an error. Without a registered listener to catch this event, the error propagates up the stack as an uncaught exception. This behavior bypasses standard try-catch blocks, causing the Node.js runtime to terminate unexpectedly.
Attack path
An unauthenticated attacker supplies a ZIP file containing corrupted DEFLATE data to an application using vulnerable adm-zip code. The application processes the file using methods such as readFileAsync, readAsTextAsync, extractAllToAsync, or getDataAsync. As the library attempts to decompress the invalid data, the missing error listener triggers an uncatchable exception. This exception terminates the Node.js process, dropping all in-flight requests and effectively denying service to legitimate users.
Affected versions
The vulnerability affects all releases of the adm-zip package maintained by cthackers prior to version 0.6.1. Applications running these older versions remain vulnerable until they upgrade to the patched release. No other versions are currently confirmed as affected.
Mitigation
- Upgrade the adm-zip package to version 0.6.1 or later
- Validate ZIP file integrity before passing them to adm-zip methods
- Implement process-level monitoring to detect and restart crashed Node.js instances
- Restrict file input sources to trusted origins where possible
Detection notes
Security teams should monitor for sudden Node.js process terminations coinciding with file uploads. Check application logs for uncaught exception errors originating from adm-zip or zlib modules. Look for patterns where service availability drops immediately after processing compressed archives. Verify that error handling routines are active in all asynchronous file operations. Ensure that process managers are configured to restart services automatically upon crash, maintaining availability while root causes are investigated.
What to do and how to stay safe: adm-zip
- Audit your Node.js applications for usage of the adm-zip library and check current versions
- Implement strict input validation for all uploaded compressed files before processing
- Monitor process health and set up alerts for unexpected Node.js runtime crashes
- Plan to upgrade to adm-zip 0.6.1 as soon as the vendor provides the update
Step-by-step guide: Unpatched Software Myths: Why Common Beliefs Fail to Protect You
General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-114102?
The vulnerability has a CVSS score of 8.7, which is classified as High severity.
Which adm-zip methods trigger this denial-of-service flaw?
The flaw is triggered by readFileAsync, readAsTextAsync, extractAllToAsync, and getDataAsync.
Is there a known exploit in the wild for this vulnerability?
The source material does not confirm whether this vulnerability is currently being exploited in the wild.
