[CVE-2026-39244] Denial of service via unbounded Buffer.alloc from crafted uncompressed-size header #568

Summary

adm-zip (<= 0.5.17) allocates a buffer based on the uncompressed-size field read directly from the ZIP central directory header, with no upper bound and no check against the compressed size. A ~120-byte ZIP declaring a ~4 GB uncompressed size triggers a ~4 GB Buffer.alloc() before any CRC validation, crashing the Node.js process (out of memory).

• CVE: CVE-2026-39244
• CWE: CWE-400 / CWE-789 (Uncontrolled Resource Consumption / Memory Allocation with Excessive Size Value)
• Affected versions: adm-zip <= 0.5.17
• Fixed: no fix released yet
• Attack vector: remote (crafted ZIP), no authentication required

Affected component

zipEntry.js (line ~103):
var data = Buffer.alloc(_centralHeader.size);

_centralHeader.size comes from entryHeader.js (line ~266):
_size = data.readUInt32LE(Constants.CENLEN)

read with no validation or upper bound.

Impact

Any application that processes an untrusted ZIP via readFile(), readAsText(), extractEntryTo(), extractAllTo(), extractAllToAsync(), test(), or entry.getData() can be crashed with a single small file. Amplification ratio
exceeds 33,000,000:1. The allocation happens before CRC validation, so the payload cannot be rejected early.

Proof of concept

A minimal (~120-byte) ZIP with the uncompressed-size fields in the central directory header (CENLEN) and local file header (LOCLEN) set to 0xFFFFFFFF (~4 GB):

const AdmZip = require('adm-zip');
// craftedZip = Buffer of a ~120-byte ZIP with CENLEN/LOCLEN = 0xFFFFFFFF
const zip = new AdmZip(craftedZip);
zip.getEntries()[0].getData(); // Buffer.alloc(~4GB) -> process crash (OOM)

Suggested fix

Validate _centralHeader.size against compressedSize with a maximum allowed compression ratio, or cap the allocation with a configurable limit before Buffer.alloc().

CVE already reserved by MITRE. Reported by Daniel Pua (devploit).