CVE-2026-114102

A flaw was found in adm-zip. A remote, unauthenticated attacker could cause a Denial of Service (DoS) by submitting a malformed or corrupted ZIP archive to an application using asynchronous decompression. Because the library fails to properly handle decompression stream errors, processing the invalid file triggers an unhandled exception that crashes the entire application process.

This vulnerability is rated with an Important severity because an unauthenticated remote attacker can trigger an unrecoverable process crash in affected Node.js services, disrupting availability for all concurrent users without requiring elevated privileges. Within Red Hat product environments, adm-zip is embedded in select containerized components and user-interface plugins where archives may be processed asynchronously. The blast radius is restricted to instances that ingest untrusted ZIP files via non-blocking workflows, while deployments that do not expose archive parsing to external network traffic remain unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.