Vulnpedia
← Search CVEs

CVE-2026-114102

HIGH 8.7

Published 2026-10-21 · Last modified 2026-10-22

adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.js process via a malformed ZIP file, because inflateAsync in methods/inflater.js lacks a zlib stream error listener. Attackers can supply a ZIP with corrupted DEFLATE data processed by readFileAsync, readAsTextAsync, extractAllToAsync, or getDataAsync, triggering an uncatchable exception that terminates all in-flight requests.

ELEVATED IMPACT

Severe if exploited (CVSS 8.7), but no known exploitation and low modeled probability. Patch on a normal cadence.

Exploitation likelihood

0.5%chance of exploitation in 30 days · 39th percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

8.7CVSS 4.0 · HIGH

  • ConfidentialityNone
  • IntegrityNone
  • AvailabilityHigh

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ✓Privileges: No account or privileges required
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable
  • ✓Requirements: No special attack requirements

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Cthackers

Products Adm Zip

Weakness (CWE)

  • CWE-248: Uncaught Exception

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References and research data (JSON)

Packages and version ranges

Each advisory describes its own package and affected ranges. A boundary applies to that range; it is not a universal upgrade recommendation.

  • adm-zip npm

    pkg:npm/adm-zip

    SEMVER range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 0.6.1
    Additional upstream package constraints
    {
  "database": {
    "last_known_affected_version_range": "<= 0.6.0",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-8238-w5pm-2374/GHSA-8238-w5pm-2374.json"
  }
}
    GitHub Advisory Database · GHSA-8238-w5pm-2374 · Updated 2026-10-21T10:57:20.841093060Z

Vendor product assessments

  • rhdh/rhdh-hub-rhel9 as a component of Red Hat Developer Hub · known affected

    Vendor assessment for this product only.

    pkg:oci/rhdh-hub-rhel9@sha256:0f02ae0b8405912741a180af1c290feac2003e69d062bec9c7cd5d13f8732dc9?repository_url=registry.redhat.io/rhdh/rhdh-hub-rhel9

    • none available: Affected
    Red Hat · CVE-2026-114102 · Updated 2026-10-22T22:18:35+00:00
  • rhoai/odh-core-bff-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/odh-core-bff-rhel9@sha256:e683d11de1a782b2a796c99eccb5dfb3b908e721210ba87c2e06768f1fa8745d?repository_url=registry.redhat.io/rhoai/odh-core-bff-rhel9

    • none available: Affected
    Red Hat · CVE-2026-114102 · Updated 2026-10-22T22:18:35+00:00
  • rhoai/odh-dashboard-operator-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/odh-dashboard-operator-rhel9@sha256:0f0a7c4386c958d30b1be5dcbec6a98ae5cabbdfb93570849991912cf318ae99?repository_url=registry.redhat.io/rhoai/odh-dashboard-operator-rhel9

    • none available: Affected
    Red Hat · CVE-2026-114102 · Updated 2026-10-22T22:18:35+00:00
  • rhoai/odh-dashboard-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/odh-dashboard-rhel9@sha256:3598eb7647c5b3489db1eeb00db8e842a0b7208205718e817689fedf0fe194f2?repository_url=registry.redhat.io/rhoai/odh-dashboard-rhel9

    • none available: Affected
    Red Hat · CVE-2026-114102 · Updated 2026-10-22T22:18:35+00:00
  • rhoai/odh-mod-arch-agent-ops-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/odh-mod-arch-agent-ops-rhel9@sha256:bf5e5b308f9f167fe21c2ac0f8f7dd65af47bbd7d0c3396b66fbe62620d853b4?repository_url=registry.redhat.io/rhoai/odh-mod-arch-agent-ops-rhel9

    • none available: Affected
    Red Hat · CVE-2026-114102 · Updated 2026-10-22T22:18:35+00:00
  • rhoai/odh-mod-arch-automl-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/odh-mod-arch-automl-rhel9@sha256:5cfd714e9a5fa61ed867771fbbb2b22e5a79ad05fd6940fa80dab09dfa43aef6?repository_url=registry.redhat.io/rhoai/odh-mod-arch-automl-rhel9

    • none available: Affected
    Red Hat · CVE-2026-114102 · Updated 2026-10-22T22:18:35+00:00
  • rhoai/odh-mod-arch-autorag-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/odh-mod-arch-autorag-rhel9@sha256:ae98ca5f53502bd9f40f74ad9f834676200cf65773f139829d13a69aed8a0de9?repository_url=registry.redhat.io/rhoai/odh-mod-arch-autorag-rhel9

    • none available: Affected
    Red Hat · CVE-2026-114102 · Updated 2026-10-22T22:18:35+00:00
  • rhoai/odh-mod-arch-eval-hub-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/odh-mod-arch-eval-hub-rhel9@sha256:147f35cb1319e707ca9c3d68be2c6eb026bde915b8ffee9e22b003403b8e2896?repository_url=registry.redhat.io/rhoai/odh-mod-arch-eval-hub-rhel9

    • none available: Affected
    Red Hat · CVE-2026-114102 · Updated 2026-10-22T22:18:35+00:00
  • rhoai/odh-mod-arch-gen-ai-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/odh-mod-arch-gen-ai-rhel9@sha256:aa5a8ab4112bf9d6a356740103d97497f7b76071ab979eeb3d6a86322f928e31?repository_url=registry.redhat.io/rhoai/odh-mod-arch-gen-ai-rhel9

    • none available: Affected
    Red Hat · CVE-2026-114102 · Updated 2026-10-22T22:18:35+00:00
  • rhoai/odh-mod-arch-maas-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/odh-mod-arch-maas-rhel9@sha256:f46aa6658c532ac9e8fcb3feeb5d764d9ee0eaf9e8af0563e87ef3998b5e426e?repository_url=registry.redhat.io/rhoai/odh-mod-arch-maas-rhel9

    • none available: Affected
    Red Hat · CVE-2026-114102 · Updated 2026-10-22T22:18:35+00:00
  • rhoai/odh-mod-arch-mlflow-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/odh-mod-arch-mlflow-rhel9@sha256:59d595add75040b8408c9536c0b7fb422f437b5ae359c0324b54cb1e1718c995?repository_url=registry.redhat.io/rhoai/odh-mod-arch-mlflow-rhel9

    • none available: Affected
    Red Hat · CVE-2026-114102 · Updated 2026-10-22T22:18:35+00:00
  • rhoai/odh-mod-arch-model-registry-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/odh-mod-arch-model-registry-rhel9@sha256:7051b4bc1631d4be790d6ad2b1c8cb579090dfaeb39e17ba91037b6cb456a8c7?repository_url=registry.redhat.io/rhoai/odh-mod-arch-model-registry-rhel9

    • none available: Affected
    Red Hat · CVE-2026-114102 · Updated 2026-10-22T22:18:35+00:00
  • costmanagement/costmanagement-ui-rhel10 as a component of Cost Management On Premise · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d?repository_url=registry.redhat.io/costmanagement/costmanagement-ui-rhel10

    Red Hat · CVE-2026-114102 · Updated 2026-10-22T22:18:35+00:00
  • rhacm2/volsync-operator-bundle as a component of Red Hat Advanced Cluster Management for Kubernetes 2 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/volsync-operator-bundle@sha256:7de09e5394985cdec87f5afab65b3343b8a37c0eb7f778774b21933ae69d691c?repository_url=registry.redhat.io/rhacm2/volsync-operator-bundle

    Red Hat · CVE-2026-114102 · Updated 2026-10-22T22:18:35+00:00
  • rhacm2/volsync-rhel9 as a component of Red Hat Advanced Cluster Management for Kubernetes 2 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/volsync-rhel9@sha256:dec387317abbe8f550227d41a8b5cf48b054c31d077c818de7cc6b927e04295d?repository_url=registry.redhat.io/rhacm2/volsync-rhel9

    Red Hat · CVE-2026-114102 · Updated 2026-10-22T22:18:35+00:00
  • rh-podman-desktop as a component of Red Hat Build of Podman Desktop · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:generic/rh-podman-desktop@3c6fc75a2a6cf5bb9b8a667fddcbbf428132badc?vcs_url=git%2Bhttps://pkgs.devel.redhat.com/git/rpms/rh-podman-desktop

    Red Hat · CVE-2026-114102 · Updated 2026-10-22T22:18:35+00:00
  • mozjs60 as a component of Red Hat Enterprise Linux 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/mozjs60

    Red Hat · CVE-2026-114102 · Updated 2026-10-22T22:18:35+00:00
  • mozjs60-devel as a component of Red Hat Enterprise Linux 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/mozjs60-devel

    Red Hat · CVE-2026-114102 · Updated 2026-10-22T22:18:35+00:00
  • mozjs60.src as a component of Red Hat Enterprise Linux 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/mozjs60?arch=src

    Red Hat · CVE-2026-114102 · Updated 2026-10-22T22:18:35+00:00
  • gjs-devel as a component of Red Hat Enterprise Linux 9 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/gjs-devel

    Red Hat · CVE-2026-114102 · Updated 2026-10-22T22:18:35+00:00
  • gjs.src as a component of Red Hat Enterprise Linux 9 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/[email protected]?arch=src

    Red Hat · CVE-2026-114102 · Updated 2026-10-22T22:18:35+00:00
  • adm-zip as a component of Red Hat Fuse 7 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not in execute path

    pkg:npm/[email protected]

    Red Hat · CVE-2026-114102 · Updated 2026-10-22T22:18:35+00:00
  • openshift4/ose-monitoring-plugin-rhel9 as a component of Red Hat OpenShift Container Platform 4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/ose-monitoring-plugin-rhel9@sha256:a86115f860bb2433857a9b9f4a423f5934c4b2937ea61092f439805a27eb5e04?repository_url=registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9

    Red Hat · CVE-2026-114102 · Updated 2026-10-22T22:18:35+00:00
  • ansible-automation-platform/automation-portal as a component of Self-service automation portal 2 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/automation-portal@sha256:cd22d7068dc9cdc475f4cb097b9019f54d5adf51927a3773c483040224018e96?repository_url=registry.redhat.io/ansible-automation-platform/automation-portal

    Red Hat · CVE-2026-114102 · Updated 2026-10-22T22:18:35+00:00

Unverified PoC candidates

Catalogue matches for further research. These repositories have not been validated as working exploits.

1 candidate

All CVSS metrics

  • HIGH 8.7 v4.0 · CNA Primary
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  • HIGH 7.5 v3.1 · CNA Primary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  • HIGH 8.7 v4.0 · NVD Secondary
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  • HIGH 7.5 v3.1 · NVD Secondary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Exploit-tagged references (not proof of a PoC)

Advisories

Technical & other

Sources: NVD · CVE.org · EPSS