{"id":"CVE-2026-92000","revision":"50fd457660f14e34b29d2afae1adcfb4","records":[{"revision":"50fd457660f14e34b29d2afae1adcfb4","observedAt":"2026-10-25T16:19:22.228+00:00","statement":{"source":"nvd","id":"CVE-2026-92000","aliases":[],"title":"adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP entries declare zero uncompressed size. Attackers can craft malicious ZIP archives with highly compressible entries declaring zero size to exhaust…","description":"adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP entries declare zero uncompressed size. Attackers can craft malicious ZIP archives with highly compressible entries declaring zero size to exhaust memory and cause denial of service.","state":0,"publishedAt":"2026-09-15T21:16:49.167+00:00","modifiedAt":"2026-09-24T21:08:55.03+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · disclosure@vulncheck.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":8.7,"severity":"HIGH"},{"system":"CVSS 3.1 · disclosure@vulncheck.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":"HIGH"}],"references":["https://github.com/cthackers/adm-zip","https://github.com/cthackers/adm-zip/blob/v0.6.0/methods/inflater.js","https://github.com/cthackers/adm-zip/commit/491600683dacb6cb9fe0718a0eeb9cb5eb49afa6","https://github.com/cthackers/adm-zip/commit/8bc411184de1b5ca28138c53074fb61119994dde","https://github.com/cthackers/adm-zip/security/advisories/GHSA-rcw4-f5rp-g42v","https://www.vulncheck.com/advisories/adm-zip-0.5.14-through-0.6.0-denial-of-service-via-zero-declared-uncompressed-size"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92000","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-409"],"productCriteria":[],"sourceDates":{"published":"2026-09-15T21:16:49.167","lastModified":"2026-09-24T21:08:55.030"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-92000","identifiers":["CVE-2026-92000"]},"retained":false,"historicalAffected":[]}],"coverage":[]}