CVE-2026-114103 cthackers CVE debrief

Who should care

Node.js developers and maintainers who use the adm-zip library, especially those who perform asynchronous I/O operations, should be aware of this vulnerability. They should assess their exposure and consider upgrading to a fixed version of the library or implementing additional validation to mitigate the risk.

Why it matters

CVE-2026-114103 is a vulnerability in the adm-zip library for Node.js that allows for decompression bomb attacks due to inconsistent enforcement of maxOutputLength in its asynchronous getDataAsync() method. Defenders should prioritize verifying the use of adm-zip in their applications, assessing exposure, and considering upgrades or additional validation to mitigate the risk.

• Potential for decompression bomb attacks leading to resource exhaustion.
• Bypass of intended security controls due to inconsistent enforcement of maxOutputLength.
• Need for verification of adm-zip version used in applications.
• Potential for denial-of-service (DoS) attacks.

Technical summary

The adm-zip library for Node.js has a vulnerability in its getDataAsync() method, which does not enforce a maxOutputLength guard unlike its synchronous counterpart, getData(). This allows for potential decompression bomb attacks if an attacker can provide a specially crafted zip file. The vulnerability is fixed in version 0.6.1 of the library. Defenders should prioritize verifying the use of adm-zip in their Node.js applications, especially where asynchronous I/O operations are common, and assess whether the version used is prior to 0.6.1.

Defensive priority

Defenders should prioritize verifying the use of adm-zip in their Node.js applications, especially where asynchronous I/O operations are common, and assess whether the version used is prior to 0.6.1. They should also review their codebase for any instances of getDataAsync() being used without proper size checks, and consider implementing additional validation or upgrading to a fixed version of adm-zip.

Recommended defensive actions

• Verify the version of adm-zip used in your Node.js applications and upgrade to version 0.6.1 or later if necessary.
• Review your codebase for instances of getDataAsync() being used without proper size checks and implement additional validation if needed.
• Consider adding monitoring to detect potential decompression bomb attacks.
• Perform a thorough review of your application to identify any potential exposure to this vulnerability.
• Implement compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Review relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The evidence provided indicates that the adm-zip library does not enforce a maxOutputLength guard in its asynchronous getDataAsync() path, unlike its synchronous getData() counterpart. This discrepancy could allow for decompression bomb attacks if not properly mitigated. The source item details and references suggest that a fix is available in version 0.6.1 of the library.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.