AIKIDO-2026-278115
@zip.js/zip.js is vulnerable to Denial of Service (DoS)
79
High Risk
This Affects:
@zip.js/zip.jsTL;DR
ZipReader discovers the end-of-central-directory (EOCD) record by scanning for the first matching signature from the end of the archive, without requiring that the chosen record be the last end-anchored entry that actually points at a central directory. A crafted archive can embed EOCD-like signatures in the comment or in appended data so recovery picks a wrong or forged directory, and under tolerant handling a stray signature can hijack the fallback scan. On random-access readers such as HttpRangeReader, probing many unreachable comment-stuffed candidates can also amplify into a large number of range reads and degrade availability. The fix selects the correct end-anchored reachable EOCD, prefers the reconciled central-directory offset, refuses ambiguous comment-cloak polyglots under stricter modes, and bounds reachability probes.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application parses untrusted ZIP archives with ZipReader.
Background info
@zip.js/zip.js is vulnerable to Denial of Service (DoS) in versions 2.0.0 - 2.8.29.
How to fix this
Upgrade the @zip.js/zip.js library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant