ZDF
Sign inSign up

Vulnerabilities

Security fix · CVE-2026-114104

adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content

Published Sep 29, 2026 · catalog updated Oct 21, 2026 · adm-zip: Duplicate ZIP entry

Open the advisory

Exploitation likelihood is not on this record for CVE-2026-114104. A missing EPSS score is not a low risk. Compare adm-zip: Duplicate ZIP entry with the linked advisory before you change production.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (adm-zip: Duplicate ZIP entry).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
  • EPSS is missing. A missing score is not a low risk.
Severity
Medium5.9
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
Awaiting synchronization with FIRST
Remediation
Advisory link
Affected products
npm adm-zip

### Summary A ZIP file can contain two entries with the identical name. adm-zip keeps both in its internal entry list, but its name-lookup table only retains the last one written. and walk these two different internal structures, so they can each resolve a duplicate name to a *different* entry. An application that validates a named entry's contents via before trusting an archive, then extracts the whole archive, can end up approving one file's content while a different file's bytes are what actually land on disk under that name. ### Details - retains both entries in but overwrites with only the last one written. - uses for lookups — returns the *last* duplicate. - iterates for extraction — writes the *first* duplicate (sync, default overwrite policy). ### PoC Reproduced on the pinned commit ( ) ### Impact An application that checks a named entry's content before trusting an untrusted ZIP, then extracts it, can be made to approve different bytes than what actually gets written to disk — the classic check/use split that this kind of validate-then-extract pattern relies on.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • npm adm-zip0 → 0.6.1

How to fix CVE-2026-114104

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

Exploitation likelihood is not on this record for CVE-2026-114104. A missing EPSS score is not a low risk. Compare adm-zip: Duplicate ZIP entry with the linked advisory before you change production.

Which versions are affected?

Compare what you have installed with 0 → 0.6.1. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-436; CWE-696. EPSS is not on this record yet. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Sep 29, 2026 · GitHub Advisory Database

    Detected

    ### Summary A ZIP file can contain two entries with the identical name. adm-zip keeps both in its internal entry list, but its name-lookup table only retains the last one written. and walk these two different internal structures, so they can each resolve a duplicate name to a *different* entry. An application that validates a named entry's contents via before trusting an archive, then extracts the

  2. Oct 21, 2026 · GitHub Advisory Database

    Fix available

    adm-zip fixed in 0.6.1

  3. Oct 21, 2026 · GitHub Advisory Database

    Fix available

    adm-zip fixed in 0.6.1

  4. Oct 21, 2026 · GitHub Advisory Database

    Updated

    ### Summary A ZIP file can contain two entries with the identical name. adm-zip keeps both in its internal entry list, but its name-lookup table only retains the last one written. and walk these two different internal structures, so they can each resolve a duplicate name to a *different* entry. An application that validates a named entry's contents via before trusting an archive, then extracts the

Sources

References

Freshness

Last verified in this catalog Oct 21, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.