Adm‑zip 0.6.0 contains a flaw that lets an attacker bypass the built‑in decompression‑bomb guard when using the asynchronous getDataAsync() method. The vulnerability arises from a failure to evaluate the maxOutputLength properly (CWE‑400) and from allowing ZIP entries with falsified declared sizes (CWE‑409). By crafting ZIP entries with a small declared size but a high‑ratio DEFLATE payload, an attacker can cause the library to allocate large amounts of memory while reading the ZIP entry asynchronously, thereby exhausting the heap and bringing the application to a halt.

The vulnerable product is the JavaScript ZIP library adm‑zip, version 0.6.0, distributed by cthackers. Applications that import this library and process ZIP files sent by users are directly affected.

The flaw scores a 6.9 on the CVSS scale and has an EPSS score of less than 1 %, indicating a low probability of exploitation. It is not listed in the CISA KEV catalog. An attacker can trigger the vulnerability by supplying a specially crafted ZIP file to any instance of an application that uses adm‑zip’s getDataAsync() path. No special privileges or code execution beyond denial of service are required; the attack is local or remote depending on how the library is exposed in the target application.