The vulnerability arises from an unhandled error listener in the inflateAsync function of adm‑zip. A malformed ZIP file containing corrupted DEFLATE data can be processed via readFileAsync, readAsTextAsync, extractAllToAsync or getDataAsync, resulting in an uncaught exception that terminates the Node.js process. Because the exception propagates without being caught, all currently running requests are aborted, causing a denial of service to the application.

Affected systems are installations of the adm‑zip library before version 0.6.1. The product is maintained by cthackers and reaches all Node.js applications that import or use adm‑zip directly or indirectly.

The CVSS score of 8.7 indicates a high severity denial of service. The EPSS score is below 1 %, implying that widespread exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. Attackers only need to supply a crafted ZIP file, which can be done through any user‑supplied input or authenticated download if adm‑zip is used to process external archives. Because the crash affects all in‑flight requests, the availability impact is significant, especially when running without an automatic restart mechanism.