CVE-2026-77301: Uncontrolled Resource Allocation (Decompression Bomb) in adm-zip

CVE-2026-77301 represents a critical uncontrolled resource allocation vulnerability within the adm-zip Node.js library, affecting all versions prior to 0.6.1. This library is widely integrated across Node.js applications to facilitate archive construction, parsing, and extraction operations. When processing untrusted archives, applications rely heavily on parser-level constraints to prevent resource exhaustion attacks.

The vulnerability is classified under CWE-789 (Memory Allocation with Excessive Size Value) and CWE-770 (Allocation of Resources Without Limits or Throttling). It specifically affects the asynchronous extraction path triggered via getDataAsync(). An attacker can leverage this weakness to submit highly compressed payload streams, inducing rapid exhaustion of the V8 heap and a complete application crash.

The attack vector is network-based and requires no authentication or user interaction. Any exposed API endpoint that accepts file uploads and uses vulnerable versions of adm-zip to extract the payload is fully susceptible to this Denial of Service vector.

The root cause of the vulnerability lies in the interaction between adm-zip and Node.js's native zlib streaming implementation. During decompression, the library's getData() function in zipEntry.js extracts the uncompressed size (expectedLength) from the ZIP file's central directory headers. It then initializes a streaming decompression instance via zlib.createInflateRaw.

To bound memory allocation, adm-zip passes an options object containing maxOutputLength: expectedLength to the stream. However, while Node's synchronous, single-pass unzipSync methods respect maxOutputLength, Node's asynchronous streaming zlib API completely ignores this configuration parameter.

Consequently, the stream's data event handler continuously receives decompressed data chunks. These chunks are appended to a local memory array without any verification. Additionally, if the archive entry specifies an expectedLength of 0, the library omits the size limits entirely, leaving even the synchronous fallback execution path unprotected against decompression bombs.

In vulnerable versions of adm-zip (prior to 0.6.1), the logic in methods/inflater.js initialized the stream configuration by verifying that the declared size was non-zero:

// Vulnerable logic in adm-zip < 0.6.1
const option = version >= 15 && expectedLength > 0 ? { maxOutputLength: expectedLength } : {};

If the declared size was zero, the option structure remained empty, disabling the memory allocation cap. During stream processing, the library appended incoming data chunks to the memory array blindly:

// Vulnerable streaming collection loop
tmp.on("data", function (data) {
    parts.push(data);
    total += data.length;
});

In version 0.6.1, the maintainers corrected this behavior. The patch guarantees that a floor value of 1 is utilized for any entry declaring zero bytes, ensuring the option is always populated. Crucially, the library now enforces the boundary manually inside the streaming loop:

// Patched logic in adm-zip 0.6.1
const maxOutputLength = expectedLength > 0 ? expectedLength : 1;
const option = version >= 15 ? { maxOutputLength } : {};
 
// Manual cap verification in user-land JavaScript
tmp.on("data", function (data) {
    if (done) return;
    total += data.length;
    
    // Stop decompression immediately if the boundary is exceeded
    if (total > maxOutputLength) {
        return fail(Errors.MAX_OUTPUT_EXCEEDED());
    }
    parts.push(data);
});

This manual check successfully mitigates the limitation of Node's native streaming zlib implementation, destroying the stream and throwing an error if the accumulated size exceeds the declared limits.

Exploiting this vulnerability requires the construction of a customized zip bomb (decompression bomb). An attacker creates a highly compressed stream of redundant data (such as zero-bytes) that compresses to a negligible size (e.g., 10 KB) but expands into multiple gigabytes upon inflation.

Using specialized tooling or manual binary editing, the attacker manipulates the Central Directory headers of the ZIP file. They overwrite the uncompressed size metadata field for the entry, setting it to 0 or to an extremely high, falsified value.

The attacker then uploads the file to the target Node.js endpoint. Once received, the application invokes asynchronous decompression via the vulnerable package:

const AdmZip = require('adm-zip');
const zip = new AdmZip(req.files.upload.data);
zip.getEntries().forEach(entry => {
    entry.getDataAsync((data, err) => {
        // Application logic
    });
});

The unconstrained streaming process rapidly consumes heap memory. Within seconds, the V8 engine reaches its internal memory limit, leading to an uncatchable heap Out-of-Memory exception and crashing the entire server process.

The impact of CVE-2026-77301 is a complete and immediate loss of availability for the targeted service. Because Node.js applications typically run on a single-threaded event loop, a process-level crash drops all active client connections and prevents the processing of any new incoming requests.

The CVSS v3.1 base score is 7.5 (High), reflecting the lack of required privileges or user interaction:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

In containerized cloud environments, orchestration tools such as Kubernetes may attempt to restart the container following the crash. However, if the malicious request is automatically retried, or if the system processes the payload synchronously on startup, the application will enter an infinite crash loop, maintaining a state of persistent Denial of Service.

The only complete and secure remediation path is to upgrade the adm-zip dependency to version 0.6.1 or later. This introduces the manual verification loop to enforce memory limits during decompression streams.

To upgrade the package in your Node.js application, run:

npm install adm-zip@0.6.1

If upgrading is not immediately possible, implement server-side mitigations. Restrict maximum file upload sizes at your reverse proxy, API gateway, or Web Application Firewall (WAF) to prevent the delivery of large zip archives. Additionally, configure process managers such as PM2 to monitor memory utilization and limit crash-loop frequencies.