Node.js Adm-zip vulnerabilities

• cthackers adm-zip adm-zip through 0.6.1 Duplicate-Entry Validation Bypass via Canonically Equivalent Names CVE-2026-116137 6.3 MediumOctober 25, 2026
• cthackers adm-zip Adm-zip before 0.6.1 Privilege Escalation via keepOriginalPermission Setuid Bits CVE-2026-114105 6.9 MediumOctober 21, 2026
• cthackers adm-zip adm-zip 0.6.0 Decompression Bomb Guard Bypass via getDataAsync() CVE-2026-114103 6.9 MediumOctober 21, 2026
• cthackers adm-zip adm-zip before 0.6.1 Denial of Service via inflateAsync Unhandled Error Event CVE-2026-114102 Public exploit 8.7 HighOctober 10, 2026
• cthackers adm-zip adm-zip before 0.6.1 Duplicate ZIP Entry Name Validation Bypass CVE-2026-114104 Fix available 8.2 HighSeptember 29, 2026
• cthackers adm-zip adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation CVE-2026-102282 Public exploitFix available 7.1 HighSeptember 29, 2026
• cthackers adm-zip adm-zip 0.5.14 through 0.6.0 Denial of Service via Zero Declared Uncompressed Size CVE-2026-92000 Fix available 8.7 HighSeptember 15, 2026
• cthackers adm-zip adm-zip 0.5.9 through 0.6.0 Arbitrary File Overwrite via Symlink Following on Extraction CVE-2026-76845 Fix available 6.8 MediumAugust 24, 2026
• cthackers adm-zip adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS) CVE-2026-77301 Fix available 7.5 HighAugust 4, 2026
• adm-zip project adm-zip Arbitrary File Write in adm-zip CVE-2018-1002204 Fix available EPSS 13.5% 5.5 MediumJuly 25, 2018