https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 22 Oct 2026 19:29:07 +0000 https://db.gcve.eu/vuln/ghsa-8238-w5pm-2374 <p><strong>Affected:</strong> npm: adm-zip</p> <p>## Summary</p> <p>Denial of Service in `adm-zip`&#39;s async decompression API allows an unauthenticated attacker to crash the entire Node.js host process by supplying a single malformed ZIP file.</p> <p>## Details</p> <p>**Affected package**: adm-zip **Affected versions**: at least 0.6.0 (current latest); likely all versions containing the current `inflateAsync` implementation in `methods/inflater.js` **Patched version**: 0.6.1</p> <p>### Root Cause</p> <p>`methods/inflater.js:12-32` (`inflateAsync`) creates a `zlib.createInflateRaw(option)` stream and feeds it attacker-controlled compressed bytes via `tmp.end(inbuf)`, but never registers an `&#34;error&#34;` listener on the stream:</p> <p>```js inflateAsync: function (/*Function*/ callback) { var tmp = zlib.createInflateRaw(option), parts = [], total = 0; tmp.on(&#34;data&#34;, function (data) { parts.push(data); total += data.length; }); tmp.on(&#34;end&#34;, function () { /* build buf, callback(buf) */ }); tmp.end(inbuf); // no tmp.on(&#34;error&#34;, ...) registered anywhere } ```</p> <p>Per Node.js `EventEmitter`/stream semantics, an `&#34;error&#34;` event emitted with zero listeners is rethrown as an **uncaught exception on a later tick**, originating from the zlib C++ binding. This cannot be caught by a `try/catch` wrapped around the calling code, because the throw happens asynchronously, outside the synchronous call stack the `try/catch` covers.</p> <p>This code path is reached from every public async API that decompresses entry data: `readFileAsync`, `readAsTextAsync`, `…</p> <p><strong>Affected:</strong> npm: adm-zip</p> <p>## Summary</p> <p>Denial of Service in `adm-zip`&#39;s async decompression API allows an unauthenticated attacker to crash the entire Node.js host process by supplying a single malformed ZIP file.</p> <p>## Details</p> <p>**Affected package**: adm-zip **Affected versions**: at least 0.6.0 (current latest); likely all versions containing the current `inflateAsync` implementation in `methods/inflater.js` **Patched version**: 0.6.1</p> <p>### Root Cause</p> <p>`methods/inflater.js:12-32` (`inflateAsync`) creates a `zlib.createInflateRaw(option)` stream and feeds it attacker-controlled compressed bytes via `tmp.end(inbuf)`, but never registers an `&#34;error&#34;` listener on the stream:</p> <p>```js inflateAsync: function (/*Function*/ callback) { var tmp = zlib.createInflateRaw(option), parts = [], total = 0; tmp.on(&#34;data&#34;, function (data) { parts.push(data); total += data.length; }); tmp.on(&#34;end&#34;, function () { /* build buf, callback(buf) */ }); tmp.end(inbuf); // no tmp.on(&#34;error&#34;, ...) registered anywhere } ```</p> <p>Per Node.js `EventEmitter`/stream semantics, an `&#34;error&#34;` event emitted with zero listeners is rethrown as an **uncaught exception on a later tick**, originating from the zlib C++ binding. This cannot be caught by a `try/catch` wrapped around the calling code, because the throw happens asynchronously, outside the synchronous call stack the `try/catch` covers.</p> <p>This code path is reached from every public async API that decompresses entry data: `readFileAsync`, `readAsTextAsync`, `…</p> https://db.gcve.eu/vuln/ghsa-8238-w5pm-2374