chore(deps): update dependency adm-zip to v0.6.0 [security] - #673
Open
renovate[bot] wants to merge 1 commit into
Open
chore(deps): update dependency adm-zip to v0.6.0 [security]#673renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
Contributor
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
0.4.11→0.6.0adm-zip: Crafted ZIP file triggers 4GB memory allocation
CVE-2026-39244 / GHSA-xcpc-8h2w-3j85
More information
Details
adm-zip before 0.5.18 is vulnerable to denial of service via a crafted ZIP file with a manipulated uncompressed size header field. In zipEntry.js line 103, Buffer.alloc(_centralHeader.size) allocates memory based on the declared uncompressed size from the ZIP central directory header without validating it against the actual compressed data size or imposing any upper bound. The size value is read directly from the binary header at entryHeader.js line 266 with no bounds check. An attacker can craft a ~120-byte ZIP file that declares ~4GB uncompressed size, causing a memory allocation amplification ratio of over 33 million to 1. The allocation occurs before CRC validation, so the malicious payload cannot be rejected early. All extraction and read methods are affected: readFile(), readAsText(), extractEntryTo(), extractAllTo(), extractAllToAsync(), test(), and entry.getData(). Any application accepting untrusted ZIP files via adm-zip is vulnerable to immediate process crash.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
cthackers/adm-zip (adm-zip)
v0.6.0Compare Source
==================
Security
Buffer.alloc(memory exhaustion / DoS) before any validation. Allocation is now bounded by the data actually present — STORED output is sized from the real bytes, DEFLATED output is grown by the inflater and capped at the declared size (#568)__proto__previously resolved toObject.prototype, crashingaddFileand hiding the entry fromgetEntry/readFile. The table is now prototype-lessBug fixes
extractAllTo/extractAllToAsyncnot restoring directory permissions withkeepOriginalPermission; directory modes are applied after their contents are written, deepest path first, and no longer lock the extractor out of a restrictive directory (#530)addLocalFolderwhen a folder contains a symlink pointing back to an ancestor (e.g. workspacenode_modules); the walk now tracks resolved real paths and skips already-visited directories (#541)ERR_INVALID_ARG_TYPE) that crashed the process whenwriteFileToAsynccould not open the target file (bad permissions, invalid filename, exhausted file descriptors); write failures are now reported through the callback and write errors are no longer silently swallowed (#470, #459, #402)name(e.g.a/b/c/now returnsc) (#466)extractEntryToflattening subdirectories whenmaintainEntryPathis false; the structure below the extracted directory is now preserved instead of collapsing (and overwriting) files by basename (#306)utimesaborting extraction; setting the modification time is now best-effort and never fails extraction of already-written content (#379)test()always returning false for any archive containing a file (it indexed the entries array with an entry object instead of reading the entry); it now correctly verifies each entry's CRCPerformance
Added
types.d.ts), so@types/adm-zipis no longer requiredNotes
extractEntryTo(dir, target, /* maintainEntryPath */ false)now preserves subdirectories beneath the extracted directory rather than flattening themv0.5.18Compare Source
What's Changed
New Contributors
Full Changelog: cthackers/adm-zip@v0.5.17...v0.5.18
v0.5.17Compare Source
What's Changed
New Contributors
Full Changelog: cthackers/adm-zip@v0.5.16...v0.5.17
v0.5.16Compare Source
What's Changed
New Contributors
Full Changelog: cthackers/adm-zip@v0.5.15...v0.5.16
v0.5.15Compare Source
What's Changed
New Contributors
Full Changelog: cthackers/adm-zip@v0.5.14...v0.5.15
v0.5.14Compare Source
Fixed an issue introduced on version 0.5.13 requiring a new mandatory parameter on the inflater on nodejs version >= 15
v0.5.13Compare Source
v0.5.12Compare Source
Fixed extraction error
v0.5.11Compare Source
v0.5.10Compare Source
v0.5.9Compare Source
v0.5.8Compare Source
v0.5.7Compare Source
v0.5.6: .Compare Source
v0.5.5Compare Source
v0.5.4Compare Source
==================
v0.5.3Compare Source
==================
v0.5.2Compare Source
==================
v0.5.1Compare Source
==================
v0.5.0Compare Source
==================
v0.4.16Compare Source
===================
v0.4.14Compare Source
===================
v0.4.13Compare Source
===================
Configuration
📅 Schedule: (in timezone America/New_York)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Never, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.