CVE-2026-114102: adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.…
adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.js process via a malformed ZIP file, because inflateAsync in methods/inflater.js lacks a zlib stream error listener. Attackers can supply a ZIP with corrupted DEFLATE data processed by readFileAsync, readAsTextAsync, extractAllToAsync, or getDataAsync, triggering an uncatchable exception that terminates all in-flight requests.
- Published by source
- 2026-10-21
- First seen by Reality Radar
- 2026-10-21
- Last verified
- 2026-10-21
What the official notice says
Risk: CVSS 8.7
Is this affecting you?
Add what you own or use and Reality Radar will tell you when official changes match it — with evidence and next steps.
Sources
- NIST National Vulnerability Database Tier A · official published 2026-10-21
Evidence ledger
Every piece of evidence we store is appended to a public hash chain, so later edits are detectable. Anyone can re-verify it.
No ledger entries yet.