adm-zip: Decompression-bomb protection (fix for CVE-2026-39244) can be bypassed by declaring uncompressed size as 0
1. Executive summary A bypass has been published for the decompression-bomb fix in adm-zip 0.6.0, the npm archive library. The fix for
29 Sep 2026 · 8 min read
read →