🚨 [security] [js] Update adm-zip 0.5.6 → 0.6.0 (major)

[depfu]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ adm-zip (0.5.6 → 0.6.0) · Repo · Changelog

Security Advisories 🚨

🚨 adm-zip: Crafted ZIP file triggers 4GB memory allocation

adm-zip before 0.5.18 is vulnerable to denial of service via a crafted ZIP file with a manipulated uncompressed size header field. In zipEntry.js line 103, Buffer.alloc(_centralHeader.size) allocates memory based on the declared uncompressed size from the ZIP central directory header without validating it against the actual compressed data size or imposing any upper bound. The size value is read directly from the binary header at entryHeader.js line 266 with no bounds check. An attacker can craft a ~120-byte ZIP file that declares ~4GB uncompressed size, causing a memory allocation amplification ratio of over 33 million to 1. The allocation occurs before CRC validation, so the malicious payload cannot be rejected early. All extraction and read methods are affected: readFile(), readAsText(), extractEntryTo(), extractAllTo(), extractAllToAsync(), test(), and entry.getData(). Any application accepting untrusted ZIP files via adm-zip is vulnerable to immediate process crash.

Release Notes

0.6.0

Full Changelog: v0.5.18...v0.6.0

This release fixes a security vulnerability (CVE-2026-39244), resolves several long-standing bugs, ships built-in TypeScript types, and includes two behavior changes worth reading before you upgrade.

• extractEntryTo(dirEntry, target, maintainEntryPath = false) now preserves subdirectories instead of flattening files into the target folder by basename (which also silently overwrote same-named files). (#306)
• Extraction no longer fails when the modification time can't be set — utimes is now best-effort. (#379)
• Minimum Node.js is now 14 (the code already required it; engines was incorrectly >=12).
• CVE-2026-39244 — a crafted archive declaring a huge uncompressed size could force an unbounded Buffer.alloc and OOM the process; allocation is now bounded by the data actually present. Reported by Daniel Púa (devploit), Anh Hong, and José Antonio Zamudio Amaya. (#568)
• Hardened entry-name lookup against object injection (proto names). Prototype-less table.
• Data-descriptor regression rejecting valid archives (#548, #533, #554)
• Directory permissions not restored on extract (#530)
• Infinite recursion on symlink loops in addLocalFolder (#541)
• Uncaught process crash in writeFileToAsync on write failure (#470, #459, #402)
• Empty name on directory entries (#466)
• test() always returned false for archives with files
• ~6× faster entry sorting for large archives
• Built-in TypeScript definitions (types.d.ts) — you can drop @types/adm-zip

0.5.18

What's Changed

• Bump js-yaml from 4.1.1 to 4.3.0 by @dependabot[bot] in #566
• Fix corrupted zip when round-tripping entries with a data descriptor (#555) by @JohnJunior in #564
• prevent crashes when process.versions is an empty object by @matt-fidd in #551
• support for writing zip64 by @mielverkerken in #562
• Fix Archive Utility failure on zips with empty directories (#558) by @JohnJunior in #563

New Contributors

• @JohnJunior made their first contribution in #564
• @matt-fidd made their first contribution in #551
• @mielverkerken made their first contribution in #562

Full Changelog: v0.5.17...v0.5.18

0.5.17

What's Changed

• entryHeader time setter more tolerant by @thomasheritage in #540
• Add check for local desc flag in crc check by @issacgerges in #543
• Create only if the directory does not exist by @DennisHill in #557
• Fix issue with absolute paths by @kwolfy in #559

New Contributors

• @thomasheritage made their first contribution in #540
• @issacgerges made their first contribution in #543
• @DennisHill made their first contribution in #557
• @kwolfy made their first contribution in #559

Full Changelog: v0.5.16...v0.5.17

0.5.16

What's Changed

• Fixing preserving linux file permissions by @NickAllmakerOpsCompass in #531
• fix: totalEntries is not defined by @sidartaveloso in #535

New Contributors

• @NickAllmakerOpsCompass made their first contribution in #531
• @sidartaveloso made their first contribution in #535

Full Changelog: v0.5.15...v0.5.16

0.5.15

What's Changed

• Fix utils canonical to valid posix by @skoniks in #499
• addFile backslash test by @5saviahv in #500
• added addLocalFolderAsync2 by @5saviahv in #501
• fixed windows paths by @roosipuu in #503
• Add Windows build by @5saviahv in #504
• inital "decoder" functionality by @5saviahv in #505
• Bump braces from 3.0.2 to 3.0.3 by @dependabot in #506
• Write out Electron original-fs auto loading by @5saviahv in #502
• using writeZip() twice throws "Invalid LOC header (bad signature)" error by @5saviahv in #507
• Descriptor check & Main Header locating by @5saviahv in #508
• House keeping by @5saviahv in #509
• typo by @5saviahv in #510
• Allow interoperability files with non-UTF-8 (bit 11 = 0) name by @yfdyh000 in #450
• package lock update by @5saviahv in #511
• small updates by @5saviahv in #513
• CodeQL check by @5saviahv in #514
• Keep local extra data by @5saviahv in #515
• Update old test by @5saviahv in #516
• make all errors a function by @5saviahv in #517
• Update date time functions by @5saviahv in #518
• Add a length check when extra field parsed by @code-sunbo in #520
• deleteFile is too eager by @5saviahv in #525

New Contributors

• @skoniks made their first contribution in #499
• @roosipuu made their first contribution in #503
• @code-sunbo made their first contribution in #520

Full Changelog: v0.5.14...v0.5.15

0.5.14

Fixed an issue introduced on version 0.1.13 requiring a new mandatory parameter on the inflater on nodejs version >= 15

0.5.13

• Fixed extractAllToAsync callback @5saviahv
• Fixed issue with "toAsyncBuffer" where after that command all entries are gone @5saviahv
• Minor fixes (tests, typos etc) @5saviahv
• Added a an option to specificy the maximum expectedLength of the file to protect against zip bombs or limit memory usage @undefined-moe
• Add check for invalid large disk entries @criyle

0.5.12

Fixed extraction error

0.5.11

Add support for Info-Zip password check spec for ZipCrypto @lukemalcolm
Extraction of password protected zip entries @Santa77
Fixed unnecessary scanning a local file headers (except in the case of corrupted archives) @likev

0.5.10

Add Unix mode attribute even when archive is created from Windows
Fixed an issue where addLocalFolderAsync causes stack overflow when a lot of files are filtered
Support to unzip symlinks
Fix parameter initialization bug of extractAllToAsync
Allow for custom stat or permissions value in addLocalFolder
Various small fixes and tests

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)