chore(deps): update dependency adm-zip to v0.6.0 [security]#2715
chore(deps): update dependency adm-zip to v0.6.0 [security]#2715renovate[bot] wants to merge 1 commit into
Conversation
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Risk: medium. Cursor Bugbot was not present on this PR, so approval is based on policy and diff review. This adm-zip security bump includes documented extraction behavior changes on CLI/backend zip paths, which exceeds the low-risk approval threshold; human review is needed before merge.
Sent by Cursor Approval Agent: Pull Request Approver External
Merging this PR will not alter performance
Comparing 
Footnotes
|
|
This PR contains the following updates:
0.5.17->0.6.0^0.5.17->^0.6.0Warning
Some dependencies could not be looked up. Check the warning logs for more information.
adm-zip: Crafted ZIP file triggers 4GB memory allocation
CVE-2026-39244 / GHSA-xcpc-8h2w-3j85
More information
Details
adm-zip before 0.5.18 is vulnerable to denial of service via a crafted ZIP file with a manipulated uncompressed size header field. In zipEntry.js line 103, Buffer.alloc(_centralHeader.size) allocates memory based on the declared uncompressed size from the ZIP central directory header without validating it against the actual compressed data size or imposing any upper bound. The size value is read directly from the binary header at entryHeader.js line 266 with no bounds check. An attacker can craft a ~120-byte ZIP file that declares ~4GB uncompressed size, causing a memory allocation amplification ratio of over 33 million to 1. The allocation occurs before CRC validation, so the malicious payload cannot be rejected early. All extraction and read methods are affected: readFile(), readAsText(), extractEntryTo(), extractAllTo(), extractAllToAsync(), test(), and entry.getData(). Any application accepting untrusted ZIP files via adm-zip is vulnerable to immediate process crash.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
cthackers/adm-zip (adm-zip)
v0.6.0Compare Source
==================
Security
Buffer.alloc(memory exhaustion / DoS) before any validation. Allocation is now bounded by the data actually present — STORED output is sized from the real bytes, DEFLATED output is grown by the inflater and capped at the declared size (#568)__proto__previously resolved toObject.prototype, crashingaddFileand hiding the entry fromgetEntry/readFile. The table is now prototype-lessBug fixes
extractAllTo/extractAllToAsyncnot restoring directory permissions withkeepOriginalPermission; directory modes are applied after their contents are written, deepest path first, and no longer lock the extractor out of a restrictive directory (#530)addLocalFolderwhen a folder contains a symlink pointing back to an ancestor (e.g. workspacenode_modules); the walk now tracks resolved real paths and skips already-visited directories (#541)ERR_INVALID_ARG_TYPE) that crashed the process whenwriteFileToAsynccould not open the target file (bad permissions, invalid filename, exhausted file descriptors); write failures are now reported through the callback and write errors are no longer silently swallowed (#470, #459, #402)name(e.g.a/b/c/now returnsc) (#466)extractEntryToflattening subdirectories whenmaintainEntryPathis false; the structure below the extracted directory is now preserved instead of collapsing (and overwriting) files by basename (#306)utimesaborting extraction; setting the modification time is now best-effort and never fails extraction of already-written content (#379)test()always returning false for any archive containing a file (it indexed the entries array with an entry object instead of reading the entry); it now correctly verifies each entry's CRCPerformance
Added
types.d.ts), so@types/adm-zipis no longer requiredNotes
extractEntryTo(dir, target, /* maintainEntryPath */ false)now preserves subdirectories beneath the extracted directory rather than flattening themv0.5.18Compare Source
What's Changed
New Contributors
Full Changelog: cthackers/adm-zip@v0.5.17...v0.5.18
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.