CVE-2026-77301

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-77301
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77301.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-77301
Aliases
Downstream
Published
2026-09-18T16:38:47Z
Modified
2026-09-19T03:47:29Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)
Details

adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, getData() in zipEntry.js trusts an entry's central-directory uncompressed size and allocates output memory before validating that value against the actual compressed data and decompression result. A small crafted ZIP can declare a multi-gigabyte uncompressed size, causing Buffer.alloc and decompression handling to commit excessive resident memory before CRC validation reports an error. Applications that read entries from untrusted archives can therefore be terminated by the operating system or suffer service-wide memory exhaustion. This issue is fixed in version 0.6.1.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-789"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77301.json"
}
References

Affected packages

Git / github.com/cthackers/adm-zip

Affected ranges

Type
GIT
Repo
https://github.com/cthackers/adm-zip
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
cb2cf9ba4c7c865db426e2de1997cb41194d9872
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.6.1"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v0.*
v0.1.1
v0.1.2
v0.1.3
v0.1.5
v0.1.7
v0.1.8
v0.1.9
v0.2.1
v0.3.1
v0.3.2
v0.4.10
v0.4.11
v0.4.13
v0.4.14
v0.4.16
v0.4.3
v0.4.4
v0.4.5
v0.4.6
v0.4.7
v0.4.8
v0.4.9
v0.5.0
v0.5.1
v0.5.10
v0.5.11
v0.5.12
v0.5.13
v0.5.14
v0.5.15
v0.5.16
v0.5.17
v0.5.18
v0.5.2
v0.5.3
v0.5.4
v0.5.5
v0.5.6
v0.5.7
v0.5.8
v0.5.9
v0.6.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77301.json"