adm-zip before 0.5.18 is vulnerable to denial of service via a crafted ZIP file with a manipulated uncompressed size header field. In zipEntry.js line 103, Buffer.alloc(_centralHeader.size) allocates memory based on the declared uncompressed size from the ZIP central directory header without validating it against the actual compressed data size or imposing any upper bound. The size value is read directly from the binary header at entryHeader.js line 266 with no bounds check. An attacker can craft a ~120-byte ZIP file that declares ~4GB uncompressed size, causing a memory allocation amplification ratio of over 33 million to 1. The allocation occurs before CRC validation, so the malicious payload cannot be rejected early. All extraction and read methods are affected: readFile(), readAsText(), extractEntryTo(), extractAllTo(), extractAllToAsync(), test(), and entry.getData(). Any application accepting untrusted ZIP files via adm-zip is vulnerable to immediate process crash.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - adm-zip before 0.5.18 is vulnerable to denial of service via a crafted ZIP file with a manipulated
    uncompressed size header field. In zipEntry.js line 103, Buffer.alloc(_centralHeader.size) allocates
    memory based on the declared uncompressed size from the ZIP central directory header without validating it
    against the actual compressed data size or imposing any upper bound. The size value is read directly from
    the binary header at entryHeader.js line 266 with no bounds check. An attacker can craft a ~120-byte ZIP
    file that declares ~4GB uncompressed size, causing a memory allocation amplification ratio of over 33
    million to 1. The allocation occurs before CRC validation, so the malicious payload cannot be rejected
    early. All extraction and read methods are affected: readFile(), readAsText(), extractEntryTo(),
    extractAllTo(), extractAllToAsync(), test(), and entry.getData(). Any application accepting untrusted ZIP
    files via adm-zip is vulnerable to immediate process crash. (CVE-2026-39244)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - adm-zip before 0.5.18 is vulnerable to denial of service via a crafted ZIP file with a manipulated     uncompressed size header field. In zipEntry.js line 103, Buffer.alloc(_centralHeader.size) allocates     memory based on the declared uncompressed size from the ZIP central directory header without validating it     against the actual compressed data size or imposing any upper bound. The size value is read directly from     the binary header at entryHeader.js line 266 with no bounds check. An attacker can craft a ~120-byte ZIP     file that declares ~4GB uncompressed size, causing a memory allocation amplification ratio of over 33     million to 1. The allocation occurs before CRC validation, so the malicious payload cannot be rejected     early. All extraction and read methods are affected: readFile(), readAsText(), extractEntryTo(),     extractAllTo(), extractAllToAsync(), test(), and entry.getData(). Any application accepting untrusted ZIP     files via adm-zip is vulnerable to immediate process crash. (CVE-2026-39244)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
444852	SCA: security update for adm-zip (GHSA-xcpc-8h2w-3j85)	Tenable Cloud Security	SCA Checks	Local	high
444852	SCA: security update for adm-zip (GHSA-xcpc-8h2w-3j85)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
326975	Linux Distros Unpatched Vulnerability : CVE-2026-39244	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-39244

high

Tenable Plugins

high

high

high