# What changed in adm-zip

> 35 changes in adm-zip 0.5 to 0.6 from its official release notes, upgrade guides and advisories: 6 breaking, 9 security, 2 new APIs and options. Each one cited. Sources checked 2026-10-17. HTML: https://unstale.sh/npm/adm-zip/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## adm-zip 0.6

### Breaking changes

- Folder archiving no longer follows symlinks outside the archived folder. (0.6.1) — [release notes](https://github.com/cthackers/adm-zip/releases/tag/v0.6.1)
- Archives containing duplicate entry names are rejected. (0.6.1) — [release notes](https://github.com/cthackers/adm-zip/releases/tag/v0.6.1)
- Extraction strips setuid, setgid, and sticky bits from file permissions. (0.6.1) — [release notes](https://github.com/cthackers/adm-zip/releases/tag/v0.6.1)
- Extraction is blocked from writing through symlinks inside the target. (0.6.1) — [release notes](https://github.com/cthackers/adm-zip/releases/tag/v0.6.1)
- Extraction now preserves subdirectories instead of flattening files into the target folder by basename, avoiding silent overwrites of same-named files. (0.6.0) — [release notes](https://github.com/cthackers/adm-zip/releases/tag/v0.6.0)
- The minimum supported Node.js version is now 14. (0.6.0) — [release notes](https://github.com/cthackers/adm-zip/releases/tag/v0.6.0)

### Security

- adm-zip: Decompression-bomb protection (fix for CVE-2026-39244) can be bypassed by declaring uncompressed size as 0 (0.6.1) — [security advisory](https://github.com/advisories/GHSA-RCW4-F5RP-G42V)
- adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content (0.6.1) — [security advisory](https://github.com/advisories/GHSA-P634-W6R4-RJP2)
- adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation (0.6.1) — [security advisory](https://github.com/advisories/GHSA-J5F4-CC29-5X44)
- adm-zip: getDataAsync() bypasses the maxOutputLength size guard enforced by the synchronous getData() path (0.6.1) — [security advisory](https://github.com/advisories/GHSA-C6FG-446Q-CG94)
- Malformed DEFLATE data no longer causes an uncaught crash during asynchronous decompression. (0.6.1) — [release notes](https://github.com/cthackers/adm-zip/releases/tag/v0.6.1), [security advisory](https://github.com/advisories/GHSA-8238-W5PM-2374)
- The size cap is enforced on the asynchronous path and when the cap is zero. (0.6.1) — [release notes](https://github.com/cthackers/adm-zip/releases/tag/v0.6.1)
- Entries whose declared data extent exceeds the buffer are rejected. (0.6.1) — [release notes](https://github.com/cthackers/adm-zip/releases/tag/v0.6.1), [security advisory](https://github.com/advisories/GHSA-7Q85-XJ36-VMFC)
- Entry-name lookup is hardened against object injection from __proto__ names. (0.6.0) — [release notes](https://github.com/cthackers/adm-zip/releases/tag/v0.6.0)
- Allocation for crafted archives declaring a huge uncompressed size is bounded by the data actually present, preventing unbounded Buffer.alloc and process OOM. (0.6.0) — [release notes](https://github.com/cthackers/adm-zip/releases/tag/v0.6.0), [security advisory](https://github.com/advisories/GHSA-XCPC-8H2W-3J85)

### New APIs and options

- Built-in TypeScript definitions are included, so users can drop @types/adm-zip. (0.6.0) — [release notes](https://github.com/cthackers/adm-zip/releases/tag/v0.6.0)

### Performance

- Entry sorting is about six times faster for large archives. (0.6.0) — [release notes](https://github.com/cthackers/adm-zip/releases/tag/v0.6.0)

### Fixes and other changes

- Local paths are no longer mangled on Windows. (0.6.1) — [release notes](https://github.com/cthackers/adm-zip/releases/tag/v0.6.1)
- The promise-based folder addition method no longer hangs on empty folders or swallows errors. (0.6.1) — [release notes](https://github.com/cthackers/adm-zip/releases/tag/v0.6.1)
- Malformed-header parse errors are routed through the asynchronous callback. (0.6.1) — [release notes](https://github.com/cthackers/adm-zip/releases/tag/v0.6.1)
- Symlink loops no longer cause infinite recursion when adding a local folder. (0.6.0) — [release notes](https://github.com/cthackers/adm-zip/releases/tag/v0.6.0)
- Valid archives rejected by a data-descriptor regression are accepted again. (0.6.0) — [release notes](https://github.com/cthackers/adm-zip/releases/tag/v0.6.0)
- Directory entries with empty names are handled. (0.6.0) — [release notes](https://github.com/cthackers/adm-zip/releases/tag/v0.6.0)
- Directory permissions are restored during extraction. (0.6.0) — [release notes](https://github.com/cthackers/adm-zip/releases/tag/v0.6.0)
- Extraction no longer fails when the modification time cannot be set; setting times is best-effort. (0.6.0) — [release notes](https://github.com/cthackers/adm-zip/releases/tag/v0.6.0)
- test() no longer always returns false for archives with files. (0.6.0) — [release notes](https://github.com/cthackers/adm-zip/releases/tag/v0.6.0)
- Write failures no longer cause an uncaught process crash. (0.6.0) — [release notes](https://github.com/cthackers/adm-zip/releases/tag/v0.6.0)

## adm-zip 0.5

### New APIs and options

- Adds support for writing ZIP64 archives. (0.5.18) — [release notes](https://github.com/cthackers/adm-zip/releases/tag/v0.5.18)

### Behavior and default changes

- The entryHeader time setter is more tolerant. (0.5.17) — [release notes](https://github.com/cthackers/adm-zip/releases/tag/v0.5.17)

### Fixes and other changes

- Fixes corrupted ZIP files when round-tripping entries with a data descriptor. (0.5.18) — [release notes](https://github.com/cthackers/adm-zip/releases/tag/v0.5.18)
- Fixes Archive Utility failures with ZIP files containing empty directories. (0.5.18) — [release notes](https://github.com/cthackers/adm-zip/releases/tag/v0.5.18)
- Prevents crashes when process.versions is an empty object. (0.5.18) — [release notes](https://github.com/cthackers/adm-zip/releases/tag/v0.5.18)
- Fixes an issue with absolute paths. (0.5.17) — [release notes](https://github.com/cthackers/adm-zip/releases/tag/v0.5.17)
- The CRC check now checks the local descriptor flag. (0.5.17) — [release notes](https://github.com/cthackers/adm-zip/releases/tag/v0.5.17)
- Directories are created only if they do not already exist. (0.5.17) — [release notes](https://github.com/cthackers/adm-zip/releases/tag/v0.5.17)