CVE-2026-77301: 
JavaScript 脆弱性の分析と軽減

CVE-2026-77301 is an uncontrolled memory allocation vulnerability in the adm-zip npm package (a JavaScript library for ZIP archive handling in Node.js) that allows unauthenticated remote attackers to cause denial of service via memory exhaustion. The flaw affects all versions prior to 0.6.1 (≤ 0.5.17). It was first published by the maintainer on September 11, 2026, and added to the GitHub Advisory Database on September 18, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Security Advisory).

The root cause is CWE-789 (Memory Allocation with Excessive Size Value): zipEntry.js calls Buffer.alloc(<declared uncompressed size>) using the untrusted value from the ZIP central directory header before performing any validation against the actual compressed data size or available bytes. An attacker can craft a minimal 105-byte ZIP archive that declares an uncompressed size of 1,774,399,200 bytes (~1.8 GB) while containing only 5 bytes of actual compressed data; when the application calls getData() on the entry, Node.js commits ~1.8 GB of resident memory in approximately 4.4 seconds before the CRC32 check can report an error. On memory-constrained hosts (containers, serverless functions, small VMs), the OS OOM-killer terminates the process before the CRC check even executes, making the error uncatchable. A public PoC reproducer is included in the advisory itself (Security Advisory).

Successful exploitation results in a complete denial of service for the affected Node.js application process — there is no confidentiality or integrity impact. On memory-constrained infrastructure (containers, serverless, small VMs), a single malicious 105-byte ZIP upload can trigger an OOM-kill of the process before any error handling can intervene; on larger hosts, concurrent requests with the same payload can exhaust system-wide memory, affecting all users of the service. The amplification ratio is approximately 16 million times the input size, making this highly efficient for an attacker (Security Advisory, GitHub Advisory).

A public proof-of-concept exploit is available within the official security advisory, consisting of a self-contained JavaScript snippet with an inline base64-encoded 105-byte malicious ZIP payload (SHA-256: 980d34356fbb248fe527b9d0ac3eabc5c99393a374014be6199523de16709386). The vulnerability is fully automatable — it requires no authentication, no user interaction, and no special privileges, only network access to a service that processes untrusted ZIP archives using adm-zip. The EPSS score is currently 0.0 and there is no evidence of in-the-wild exploitation or CISA KEV catalog listing at this time (Security Advisory, GitHub Advisory).

1. Craft the malicious ZIP: Construct or use the known 105-byte ZIP archive that declares an uncompressed size of 1,774,399,200 bytes (1.8 GB) in its central directory while containing only 5 bytes of actual stored data for an entry named a. The PoC base64 payload is: UEsDBBQAAAAAAAAAAAAAAAAABQAAAAUAAAABAAAAYWhlbGxvUEsBAhQAFAAAAAAAAAAAAAAAAAAFAAAA4C7DaQEAAAAAAAAAAAAAAAAAAAAAAGFQSwUGAAAAAAEAAQAvAAAAJAAAAAAA
2. Identify a target: Locate a Node.js web service or API endpoint that accepts ZIP file uploads or processes ZIP archives from user-supplied input and uses adm-zip version ≤ 0.5.17.
3. Deliver the payload: Submit the 105-byte malicious ZIP to the target service via any supported input channel (e.g., HTTP multipart file upload, API body, message queue payload). No authentication is required.
4. Trigger getData() execution: The application instantiates new AdmZip(buf) and calls .getEntries()[0].getData() (or equivalent), which invokes the vulnerable zipEntry.js code path.
5. Memory exhaustion occurs: Buffer.alloc(1774399200) commits ~1.8 GB of resident memory. On constrained hosts, the OS OOM-killer terminates the process before the CRC check runs; on larger hosts, repeated requests exhaust available memory, denying service to all users (Security Advisory).

• Network: Repeated HTTP requests (e.g., POST to file upload endpoints) delivering very small ZIP payloads (≤ 200 bytes) from the same or rotating source IPs; unusual traffic patterns where tiny uploads correlate with service crashes or restarts.
• Logs: Node.js process crash logs or OOM-kill events (Killed or SIGKILL) in system logs (e.g., /var/log/syslog, journalctl) immediately following ZIP file processing; application logs showing ADM-ZIP: CRC32 checksum failed errors preceding crashes.
• Process/System: Sudden spike in Node.js process memory consumption to multi-gigabyte levels within seconds of receiving a small file; kernel OOM-killer messages referencing the Node.js process (e.g., Out of memory: Kill process <pid> (node)).
• File System: Presence of the known malicious ZIP file (SHA-256: 980d34356fbb248fe527b9d0ac3eabc5c99393a374014be6199523de16709386) in upload directories or temporary storage (Security Advisory).

The primary remediation is to upgrade adm-zip to version 0.6.1 or later, which enforces a decompression size cap by validating the declared uncompressed size before allocating memory and applies the cap to both synchronous and asynchronous decompression paths (Release v0.6.1, Patch Commit). As interim workarounds for applications that cannot immediately upgrade: validate ZIP archive metadata (declared uncompressed size vs. compressed size ratio) before calling getData(); enforce per-request memory limits or process isolation (e.g., worker threads with memory caps); and process untrusted ZIP files in sandboxed environments with strict resource constraints. Avoid calling getData() on entries from untrusted archives until the library is patched (GitHub Advisory).

The vulnerability was responsibly disclosed by researcher joszamama directly to the adm-zip maintainer via GitHub's private security advisory mechanism, and the maintainer (cthackers) published the fix in v0.6.1 on September 11, 2026. The advisory was reviewed and added to the GitHub Advisory Database on September 18, 2026. No significant broader media coverage or notable social media commentary has been identified beyond standard vulnerability tracking aggregators (Security Advisory, GitHub Advisory).