# CVE-2026-77301: adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)

> CVE-2026-77301 (GitHub advisory GHSA-7q85-xj36-vmfc) is a high-severity vulnerability with a CVSS 3.1 base score of 7.5, classed as Memory Allocation with Excessive Size Value (CWE-789), in adm-zip (npm). Affected versions: < 0.6.1. It is fixed in 0.6.1.

Canonical page: https://cveminer.com/vulnerabilities/CVE-2026-77301

| Field | Value |
| --- | --- |
| CVE | CVE-2026-77301 |
| GHSA | GHSA-7q85-xj36-vmfc |
| Severity | High |
| CVSS 3.1 | 7.5 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` (GitHub Advisory Database) |
| CWE | CWE-789 Memory Allocation with Excessive Size Value |
| EPSS | 0.41% (higher than 35% of CVEs) |
| CISA KEV | Not listed |
| SSVC | exploitation poc, automatable yes, technical impact partial |
| Published | 18 Sept 2026 |
| Modified | 18 Sept 2026 |

## Description

adm-zip allocates an entry's output buffer from the declared uncompressed size (central-directory `size` field) before validating it against the actual data. A tiny crafted ZIP that declares a huge uncompressed size forces a multi-gigabyte allocation from a few bytes.

##### Impact
On adm-zip 0.5.17 (latest), Node 24, a 105-byte ZIP with one stored entry declaring size = 1,774,399,200 makes `new AdmZip(buf).getEntries()[0].getData()` commit ~1.8 GB of resident memory in ~4.4 s before throwing `Error: ADM-ZIP: CRC32 checksum failed`, roughly 16 million times the input size. Because the buffer is committed before any validation, on a memory-constrained host (containers, serverless, small VMs) the allocation OOM-kills the process before the CRC check (uncatchable), and concurrent requests can exhaust memory even on larger hosts. Any service that reads entries from untrusted ZIPs is exposed to a remote denial of service.

##### Steps to reproduce
Attachments are not supported in the advisory form, so the 105-byte PoC (sha256 `980d34356fbb248fe527b9d0ac3eabc5c99393a374014be6199523de16709386`) is inlined as base64 in this self-contained reproducer:

```js
const AdmZip = require('adm-zip');
// 105-byte crafted ZIP, base64-inlined
// sha256 980d34356fbb248fe527b9d0ac3eabc5c99393a374014be6199523de16709386
const b64 = "UEsDBBQAAAAAAAAAAAAAAAAABQAAAAUAAAABAAAAYWhlbGxvUEsBAhQAFAAAAAAAAAAAAAAAAAAFAAAA4C7DaQEAAAAAAAAAAAAAAAAAAAAAAGFQSwUGAAAAAAEAAQAvAAAAJAAAAAAA";
const buf = Buffer.from(b64, "base64");          // 105 bytes
const zip = new AdmZip(buf);
zip.getEntries()[0].getData();   // commits ~1.8 GB, then throws "ADM-ZIP: CRC32 checksum failed"
```

The single entry declares uncompressed size = 1,774,399,200 with a compressed size of 5. `getData()` allocates the full declared size before the CRC check runs, so the memory is committed regardless of the (tiny) actual payload.

##### Root cause
`zipEntry.js` does `Buffer.alloc(<declared uncompressed size>)` before checking the declared size against the compressed size / available bytes.

##### Suggested fix
Validate the declared uncompressed size against the compressed size and a configurable maximum before allocating (yauzl, for example, requires the caller to bound this); reject or stream when the declared size is implausible relative to the input. Happy to send a patch.

## Affected packages

| Package | Ecosystem | PURL | Vulnerable versions | Fixed in |
| --- | --- | --- | --- | --- |
| adm-zip | npm | `pkg:npm/adm-zip` | < 0.6.1 | 0.6.1 |

## Fix commits

- Patch: https://github.com/cthackers/adm-zip/commit/491600683dacb6cb9fe0718a0eeb9cb5eb49afa6
- Release: https://github.com/cthackers/adm-zip/commit/cb2cf9ba4c7c865db426e2de1997cb41194d9872 (0.6.1)

## Questions

**What is the GHSA ID for CVE-2026-77301?**

GitHub tracks CVE-2026-77301 as GHSA-7q85-xj36-vmfc.

**What is the CVSS score of CVE-2026-77301?**

CVE-2026-77301 has a CVSS 3.1 base score of 7.5 (High), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

**Which versions are affected by CVE-2026-77301?**

adm-zip (npm): < 0.6.1.

**How do I fix CVE-2026-77301?**

Upgrade to 0.6.1 or later. The fix is in commit 4916006.

**What is the Package URL (PURL) for CVE-2026-77301?**

The affected package's PURL is pkg:npm/adm-zip.

**Is CVE-2026-77301 exploited in the wild?**

CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2026-77301. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. CISA's SSVC assessment rates exploitation as "poc". EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 35% of CVEs.

## References

- https://github.com/cthackers/adm-zip/commit/491600683dacb6cb9fe0718a0eeb9cb5eb49afa6 (fix)
- https://github.com/cthackers/adm-zip/security/advisories/GHSA-7q85-xj36-vmfc (advisory)
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77301.json (advisory)
- https://nvd.nist.gov/vuln/detail/CVE-2026-77301 (advisory)
- https://github.com/advisories/GHSA-7q85-xj36-vmfc (advisory)
- https://github.com/cthackers/adm-zip (package)
- https://github.com/cthackers/adm-zip/releases/tag/v0.6.1

---

Source: CVEminer (https://cveminer.com/vulnerabilities/CVE-2026-77301), compiled from OSV (GitHub advisory), GitHub Advisory Database, OSV (CVE record), CVE.org, CISA KEV catalog. OSV and GitHub Advisory Database content is licensed CC BY 4.0.