GHSA-8238-w5pm-2374: adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)

September 29, 2026

Denial of Service in adm-zip’s async decompression API allows an unauthenticated attacker to crash the entire Node.js host process by supplying a single malformed ZIP file.

References

github.com/advisories/GHSA-8238-w5pm-2374
github.com/cthackers/adm-zip/commit/5e70d3a26097d68fa981c41f022c053117174e49
github.com/cthackers/adm-zip/releases/tag/v0.6.1
github.com/cthackers/adm-zip/security/advisories/GHSA-8238-w5pm-2374

Code Behaviors & Features

Detect and mitigate GHSA-8238-w5pm-2374 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →