CVE-2026-114102 cthackers CVE debrief

Who should care

Defenders responsible for Node.js applications using the `adm-zip` package should assess their exposure and prioritize updating to version 0.6.1 or later to prevent potential denial-of-service attacks.

Why it matters

A denial-of-service vulnerability in `adm-zip`'s async decompression API requires defenders to update to version 0.6.1 or later and implement proper error handling to prevent potential attacks.

• Potential denial-of-service attacks on Node.js host processes
• Crashing of Node.js host processes due to unhandled error events
• Need for proper error handling in applications using affected `adm-zip` versions
• Priority on updating to version 0.6.1 of `adm-zip`

Technical summary

The `adm-zip` package has a vulnerability in its async decompression API that allows an unauthenticated attacker to crash the entire Node.js host process by supplying a single malformed ZIP file. The vulnerability is caused by an unhandled error event in the `inflateAsync` function, which creates a `zlib.createInflateRaw` stream and feeds it attacker-controlled compressed bytes without registering an error listener.

Defensive priority

Defenders should prioritize updating to version 0.6.1 of `adm-zip` to prevent potential denial-of-service attacks. Node.js host process crashes can be mitigated by ensuring that error handling is properly implemented in applications using the affected `adm-zip` versions.

Recommended defensive actions

• Update `adm-zip` to version 0.6.1 or later
• Implement proper error handling in applications using affected `adm-zip` versions
• Verify that Node.js host processes are not vulnerable to denial-of-service attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by the lack of an error listener in the `inflateAsync` function of `methods/inflater.js`. This leads to an uncaught exception when an error event is emitted, resulting in the Node.js host process crashing.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.