Description (CNA)
adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the maxOutputLength guard by targeting the asynchronous getDataAsync() path in methods/inflater.js. Attackers can craft ZIP entries with falsified small declared sizes and high-ratio DEFLATE payloads to exhaust memory in applications reading entries asynchronously.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| cthackers / adm-zip | affected 0.6.0 before 0.6.1; unaffected 0.6.1 |
CWE
CWE-400