https://vulnerability.circl.lu/sightings/feed 2026-09-19T10:57:43.786166+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/7a4c587d-550c-4a8b-b5be-0652a11ccfdc/export 2026-09-19T10:57:43.792382+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "7a4c587d-550c-4a8b-b5be-0652a11ccfdc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-7q85-xj36-vmfc", "type": "seen", "source": "https://gist.github.com/alon710/43058acd721510462931518910022d1c", "content": "# CVE-2026-77301: CVE-2026-77301: Uncontrolled Resource Allocation (Decompression Bomb) in adm-zip\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-18\n> **Full Report:** https://cvereports.com/reports/CVE-2026-77301\n\n## Summary\nCVE-2026-77301 is a critical uncontrolled resource allocation vulnerability in the popular Node.js library adm-zip (versions prior to 0.6.1). During ZIP decompression of asynchronous entries, the library trusts the uncompressed size metadata declared in the central directory headers. Because Node.js's streaming zlib API completely ignores the maxOutputLength configuration, a crafted ZIP archive (decompression bomb) causes the application to continually allocate resident memory buffers on the heap without limits, causing rapid memory exhaustion and a process-level Out-of-Memory (OOM) crash.\n\n## TL;DR\nUncontrolled memory allocation in adm-zip before 0.6.1 allows unauthenticated remote attackers to trigger a Denial of Service (DoS) via a crafted ZIP archive (decompression bomb) that exhausts Node.js heap memory.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-789 / CWE-770\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 7.5 (High)\n- **Exploit Status**: PoC (Proof of Concept)\n- **CISA KEV Status**: Not Listed\n- **Impact**: Complete Denial of Service (DoS) via OOM Crash\n\n## Affected Systems\n\n- Node.js environments utilizing the adm-zip package for ZIP archive parsing\n- **adm-zip**: < 0.6.1 (Fixed in: `0.6.1`)\n\n## Mitigation\n\n- Upgrade adm-zip dependency to version 0.6.1 or later\n- Implement maximum file size checks at the API gateway or reverse proxy level\n- Validate file types before sending payloads to parser functions\n\n**Remediation Steps:**\n1. Run the command 'npm install adm-zip@latest' or specify '\"adm-zip\": \"^0.6.1\"' in your package.json file.\n2. Run 'npm audit' to ensure that no transitive dependencies are pulling in older versions of the library.\n3. Deploy input-validation middleware to inspect incoming HTTP request bodies and drop payloads exceeding safe limits before parsing.\n\n## References\n\n- [GitHub Security Advisory GHSA-7q85-xj36-vmfc](https://github.com/cthackers/adm-zip/security/advisories/GHSA-7q85-xj36-vmfc)\n- [Official Fix Commit / Code Patch](https://github.com/cthackers/adm-zip/commit/491600683dacb6cb9fe0718a0eeb9cb5eb49afa6)\n- [Release Version 0.6.1](https://github.com/cthackers/adm-zip/releases/tag/v0.6.1)\n- [National Vulnerability Database (NVD) Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-77301)\n- [CVE.org Authoritative Entry](https://www.cve.org/CVERecord?id=CVE-2026-77301)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-77301) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-19T08:31:44.326652Z"} 2026-09-19T08:31:44.326652+00:00