npm / adm-zip

adm-zip

What changed in adm-zip 0.5 to 0.6, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-17.

6 breaking9 security2 new APIs and options1 performance1 behavior and defaults16 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

adm-zip 0.627 changes

Folder archiving no longer follows symlinks outside the archived folder.
0.6.1release notes
Archives containing duplicate entry names are rejected.
0.6.1release notes
Extraction strips setuid, setgid, and sticky bits from file permissions.
0.6.1release notes
Extraction is blocked from writing through symlinks inside the target.
0.6.1release notes
Extraction now preserves subdirectories instead of flattening files into the target folder by basename, avoiding silent overwrites of same-named files.
0.6.0release notes
The minimum supported Node.js version is now 14.
0.6.0release notes

adm-zip: Decompression-bomb protection (fix for CVE-2026-39244) can be bypassed by declaring uncompressed size as 0
0.6.1security advisory
adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content
0.6.1security advisory
adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation
0.6.1security advisory
adm-zip: getDataAsync() bypasses the maxOutputLength size guard enforced by the synchronous getData() path
0.6.1security advisory
Malformed DEFLATE data no longer causes an uncaught crash during asynchronous decompression.
0.6.1release notes security advisory
The size cap is enforced on the asynchronous path and when the cap is zero.
0.6.1release notes
Entries whose declared data extent exceeds the buffer are rejected.
0.6.1release notes security advisory
Entry-name lookup is hardened against object injection from __proto__ names.
0.6.0release notes
Allocation for crafted archives declaring a huge uncompressed size is bounded by the data actually present, preventing unbounded Buffer.alloc and process OOM.
0.6.0release notes security advisory

Built-in TypeScript definitions are included, so users can drop @types/adm-zip.
0.6.0release notes

Local paths are no longer mangled on Windows.
0.6.1release notes
The promise-based folder addition method no longer hangs on empty folders or swallows errors.
0.6.1release notes
Malformed-header parse errors are routed through the asynchronous callback.
0.6.1release notes
Symlink loops no longer cause infinite recursion when adding a local folder.
0.6.0release notes
Valid archives rejected by a data-descriptor regression are accepted again.
0.6.0release notes
Directory entries with empty names are handled.
0.6.0release notes
Directory permissions are restored during extraction.
0.6.0release notes
Extraction no longer fails when the modification time cannot be set; setting times is best-effort.
0.6.0release notes
test() no longer always returns false for archives with files.
0.6.0release notes
Write failures no longer cause an uncaught process crash.
0.6.0release notes

Fixes corrupted ZIP files when round-tripping entries with a data descriptor.
0.5.18release notes
Fixes Archive Utility failures with ZIP files containing empty directories.
0.5.18release notes
Prevents crashes when process.versions is an empty object.
0.5.18release notes
Fixes an issue with absolute paths.
0.5.17release notes
The CRC check now checks the local descriptor flag.
0.5.17release notes
Directories are created only if they do not already exist.
0.5.17release notes