CVE-2026-92000Published

adm-zip 0.5.14 through 0.6.0 Denial of Service via Zero Declared Uncompressed Size

cve-program · CVE-2026-92000

Published

adm-zip

https://www.npmjs.com/package/adm-zip

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "cthackers",
                    "product": "adm-zip",
                    "defaultStatus": "unaffected",
                    "collectionURL": "https://www.npmjs.com/package/adm-zip",
                    "packageName": "adm-zip",
                    "packageURL": "pkg:npm/adm-zip",
                    "repo": "https://github.com/cthackers/adm-zip",
                    "programFiles": [
                        "methods/inflater.js"
                    ],
                    "versions": [
                        {
                            "version": "0.5.14",
                            "lessThan": "0.6.1",
                            "status": "affected",
                            "versionType": "semver"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON

euvd · EUVD-2026-80001

Published

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Sep 15, 2026, 8:56:45 PM

dateUpdated: Sep 24, 2026, 2:22:38 PM

3 related source bulletins · separate from aliases

RHSA-2026:72722: Red Hat Security Advisory: Ansible plug-ins for Red Hat Developer Hub Product Release Update

CVE-2026-19534 · CVE-2026-47683 · CVE-2026-55553 · CVE-2026-56859 · CVE-2026-59869 · CVE-2026-82417 · CVE-2026-84375 · CVE-2026-87776 · CVE-2026-88932 · CVE-2026-89011 · CVE-2026-92000 · CVE-2026-92942 · CVE-2026-92958 · CVE-2026-92959 · CVE-2026-92961

RHSA-2026:72712: Red Hat Security Advisory: Ansible plug-ins for Red Hat Developer Hub Product Release Update

CVE-2026-5038 · CVE-2026-19534 · CVE-2026-47683 · CVE-2026-55553 · CVE-2026-59869 · CVE-2026-59879 · CVE-2026-82417 · CVE-2026-84375 · CVE-2026-87776 · CVE-2026-88932 · CVE-2026-89011 · CVE-2026-92000 · CVE-2026-92942 · CVE-2026-92958 · CVE-2026-92959 · CVE-2026-92961

RHSA-2026:74609: Red Hat Security Advisory: Cluster Observability Operator 1.5.3

CVE-2026-19534 · CVE-2026-39244 · CVE-2026-41178 · CVE-2026-42504 · CVE-2026-45623 · CVE-2026-56864 · CVE-2026-56865 · CVE-2026-59887 · CVE-2026-63199 · CVE-2026-71556 · CVE-2026-73086 · CVE-2026-75899 · CVE-2026-75931 · CVE-2026-75975 · CVE-2026-76172 · CVE-2026-84292 · CVE-2026-84394 · CVE-2026-84445 · CVE-2026-84961 · CVE-2026-92000 · CVE-2026-100690

No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.

Original source record · Cite this exact observation · Complete original publisher JSON

nvd · CVE-2026-92000

Published

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Deferred

Weakness classifications: CWE-409

Original publisher date fields

published: 2026-09-15T21:16:49.167

lastModified: 2026-09-24T21:08:55.030

Original source record · Cite this exact observation · Complete original publisher JSON

osv · GHSA-rcw4-f5rp-g42v

Published

adm-zip

npm

SEMVER · introduced 0 → fixed 0.6.1

Original source record · Cite this exact observation · Complete original publisher JSON