Node.js Services Face High-Severity DoS Risk from Unpatched adm-zip Versions Before 0.6.1

The open-source library adm-zip contains a high-severity denial-of-service vulnerability that allows unauthenticated attackers to crash Node.js processes. According to the National Vulnerability Database record for CVE-2026-114102, the flaw exists in versions before 0.6.1. Attackers can exploit this by supplying malformed ZIP files with corrupted DEFLATE data. This causes an uncatchable exception that terminates all in-flight requests on the server.

How it unfolded

• The vulnerability was assigned CVE-2026-114102 by the National Vulnerability Database.
• The flaw stems from missing error handling in the inflateAsync function.
• The issue affects methods including readFileAsync and extractAllToAsync.

Who is affected

Organizations using adm-zip versions earlier than 0.6.1 are directly exposed to this risk. The National Vulnerability Database identifies the weakness as CWE-248, indicating improper handling of unexpected events. Specifically, the inflateAsync function in methods/inflater.js lacks a zlib stream error listener. This missing safeguard allows corrupted data to propagate as an uncatchable exception. Any application relying on these specific asynchronous methods to process ZIP archives is at risk of process termination.

This incident mirrors recent stability issues in Node.js ecosystem components. As Patch Observer reported on October 20, 2026, Apostrophe CMS suffered a similar high-severity crash flaw. Additionally, on October 16, 2026, Parse Server vulnerabilities allowed clients to force shutdowns. These events highlight a recurring pattern where unhandled exceptions in underlying libraries lead to service outages.

Our take on the response

The lack of a zlib stream error listener represents a critical oversight in error handling logic. By failing to catch stream errors, the library allows low-level compression failures to escalate into process-wide crashes. This suggests that developers must rigorously test error paths in asynchronous I/O operations. The high CVSS score of 8.7 reflects the ease of exploitation and the severe impact on availability. Teams should treat this as a priority remediation target.

Who needs to act first

Managed service providers should prioritize systems that accept user-uploaded ZIP files or process external archives. Inventory all Node.js applications using adm-zip to identify those running versions before 0.6.1. Roll out updates in stages, starting with internet-facing services to reduce exposure. Test the updated library in a staging environment to ensure compatibility with existing workflows. Verify that error handling mechanisms are robust before deploying to production servers.

What to do and how to stay safe: adm-zip

• Audit Node.js applications to identify usage of adm-zip versions prior to 0.6.1.
• Implement input validation to reject malformed or corrupted ZIP files at the perimeter.
• Monitor server logs for uncatchable exceptions or sudden process terminations.
• Apply the vendor update once available to resolve the missing error listener.

Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time

General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the severity of CVE-2026-114102?

The National Vulnerability Database rates CVE-2026-114102 as CVSS 8.7, which is classified as High severity.

Which versions of adm-zip are vulnerable?

All versions of adm-zip before 0.6.1 are affected by this denial-of-service vulnerability.

How do attackers exploit this flaw?

Attackers supply a ZIP file with corrupted DEFLATE data, triggering an uncatchable exception that crashes the Node.js process.