npm · #2149 most downloaded on npm

adm-zip

0.6.192M downloads/mocthackers/adm-zip ↗New releases in your daily digest, changelog included.

Javascript implementation of zip for nodejs with support for electron original-fs. Allows user to create or extract zip files both in memory or to/from disk

Last release 23 days ago
11 Sep 2026
Release timing varies
gaps range from 2 weeks to 1.6 years
Rarely documented
notes for 10 of 44 stable releases
Nothing withdrawn
no release was ever pulled
15 years old
44 releases · first in 2012

Release timeline

44 releases since 2012

2012201420162018

Releases

0.6.111 Sept 2026
Fixed uncaught crash in async decompression on malformed DEFLATE data
Full Changelog: v0.6.0...v0.6.1

Updated dev dependencies

Fixed uncaught crash in async decompression on malformed DEFLATE data

Fixed addLocalFolder following symlinks out of the archived folder

Stripped setuid/setgid/sticky bits from extracted file permissions

Enforced the decompression size cap on the async path and for size 0

Rejected archives with duplicate entry names

Blocked extraction from writing through symlinks inside the target

Routed malformed-header parse errors through the async callback

Rejected zip entries whose declared data extent runs past the buffer

Fixed addLocalFolderPromise hanging on empty folders and swallowing errors

Fixed addLocalFolderAsync2 mangling local paths on Windows
Open source →
0.6.010 Jul 2026Security
This release fixes a security vulnerability ( CVE-2026-39244 ), resolves several long-standing bugs, ships built-in TypeScript types, and includes two…
Full Changelog: v0.5.18...v0.6.0

This release fixes a security vulnerability (CVE-2026-39244), resolves several long-standing bugs, ships built-in TypeScript types, and includes two behavior changes worth reading before you upgrade.

extractEntryTo(dirEntry, target, maintainEntryPath = false) now preserves subdirectories instead of flattening files into the target folder by basename (which also silently overwrote same-named files). (#306)

Extraction no longer fails when the modification time can't be set — utimes is now best-effort. (#379)

Minimum Node.js is now 14 (the code already required it; engines was incorrectly >=12).

CVE-2026-39244 — a crafted archive declaring a huge uncompressed size could force an unbounded Buffer.alloc and OOM the process; allocation is now bounded by the data actually present. Reported by Daniel Púa (devploit), Anh Hong, and José Antonio Zamudio Amaya. (#568)

Hardened entry-name lookup against object injection (proto names). Prototype-less table.

Data-descriptor regression rejecting valid archives (#548, #533, #554)

Directory permissions not restored on extract (#530)

Infinite recursion on symlink loops in addLocalFolder (#541)

Uncaught process crash in writeFileToAsync on write failure (#470, #459, #402)

Empty name on directory entries (#466)

test() always returned false for archives with files

~6× faster entry sorting for large archives

Built-in TypeScript definitions (types.d.ts) — you can drop @types/adm-zip

One column per quarter.

0.5.1829 Jun 2026

Bump js-yaml from 4.1.1 to 4.3.0 by @dependabot [bot] in #566

What's Changed

Bump js-yaml from 4.1.1 to 4.3.0 by @dependabot[bot] in #566
Fix corrupted zip when round-tripping entries with a data descriptor (#555) by @JohnJunior in #564
prevent crashes when process.versions is an empty object by @matt-fidd in #551
support for writing zip64 by @mielverkerken in #562
Fix Archive Utility failure on zips with empty directories (#558) by @JohnJunior in #563

New Contributors

@JohnJunior made their first contribution in #564
@matt-fidd made their first contribution in #551
@mielverkerken made their first contribution in #562

Full Changelog: v0.5.17...v0.5.18

Open source →

0.5.171 Apr 2026

entryHeader time setter more tolerant by @thomasheritage in #540

What's Changed

entryHeader time setter more tolerant by @thomasheritage in #540
Add check for local desc flag in crc check by @issacgerges in #543
Create only if the directory does not exist by @DennisHill in #557
Fix issue with absolute paths by @kwolfy in #559

New Contributors

@thomasheritage made their first contribution in #540
@issacgerges made their first contribution in #543
@DennisHill made their first contribution in #557
@kwolfy made their first contribution in #559

Full Changelog: v0.5.16...v0.5.17

Open source →

0.5.1630 Aug 2024

Fixing preserving linux file permissions by @NickAllmakerOpsCompass in #531

What's Changed

Fixing preserving linux file permissions by @NickAllmakerOpsCompass in #531
fix: totalEntries is not defined by @sidartaveloso in #535

New Contributors

@NickAllmakerOpsCompass made their first contribution in #531
@sidartaveloso made their first contribution in #535

Full Changelog: v0.5.15...v0.5.16

Open source →

0.5.155 Aug 2024

Fix utils canonical to valid posix by @skoniks in #499

What's Changed

Fix utils canonical to valid posix by @skoniks in #499
addFile backslash test by @5saviahv in #500
added addLocalFolderAsync2 by @5saviahv in #501
fixed windows paths by @roosipuu in #503
Add Windows build by @5saviahv in #504
inital "decoder" functionality by @5saviahv in #505
Bump braces from 3.0.2 to 3.0.3 by @dependabot in #506
Write out Electron original-fs auto loading by @5saviahv in #502
using writeZip() twice throws "Invalid LOC header (bad signature)" error by @5saviahv in #507
Descriptor check & Main Header locating by @5saviahv in #508
House keeping by @5saviahv in #509
typo by @5saviahv in #510
Allow interoperability files with non-UTF-8 (bit 11 = 0) name by @yfdyh000 in #450
package lock update by @5saviahv in #511
small updates by @5saviahv in #513
CodeQL check by @5saviahv in #514
Keep local extra data by @5saviahv in #515
Update old test by @5saviahv in #516
make all errors a function by @5saviahv in #517
Update date time functions by @5saviahv in #518
Add a length check when extra field parsed by @code-sunbo in #520
deleteFile is too eager by @5saviahv in #525

New Contributors

@skoniks made their first contribution in #499
@roosipuu made their first contribution in #503
@code-sunbo made their first contribution in #520

Full Changelog: v0.5.14...v0.5.15

Open source →

0.5.144 Jun 2024

Fixed an issue introduced on version 0.5.13 requiring a new mandatory parameter on the inflater on nodejs version >= 15

Open source →

0.5.131 Jun 2024

Fixed extractAllToAsync callback @5saviahv

Fixed extractAllToAsync callback @5saviahv
Fixed issue with "toAsyncBuffer" where after that command all entries are gone @5saviahv
Minor fixes (tests, typos etc) @5saviahv
Added a an option to specificy the maximum expectedLength of the file to protect against zip bombs or limit memory usage @undefined-moe
Add check for invalid large disk entries @criyle

Open source →

0.5.1214 Mar 2024

Nothing published for this version

0.5.1113 Mar 2024

Add support for Info-Zip password check spec for ZipCrypto @lukemalcolm

Add support for Info-Zip password check spec for ZipCrypto @lukemalcolm
Extraction of password protected zip entries @Santa77
Fixed unnecessary scanning a local file headers (except in the case of corrupted archives) @likev
Added GitHub actions @kibertoad
Fixed cases when extra data was lost @yfdyh000
Fixed throw empty error in extractAllToAsync on operation done @Autokaka

Open source →

0.5.1020 Dec 2022

Add Unix mode attribute even when archive is created from Windows @xfournet

Add Unix mode attribute even when archive is created from Windows @xfournet
Fixed an issue where addLocalFolderAsync causes stack overflow when a lot of files are filtered @miserylee
Support to unzip symlinks @netlify-team-account-1
Fix parameter initialization bug of extractAllToAsync @robincodex
Allow for custom stat or permissions value in addLocalFolder @dilan-dio4
Various small fixes and tests @clavery and @nicholasruha

Open source →

0.5.97 Oct 2021

Nothing published for this version

0.5.87 Oct 2021

Nothing published for this version

0.5.71 Oct 2021

Nothing published for this version

0.5.612 Sept 2021

Nothing published for this version

0.5.531 Mar 2021

Nothing published for this version

0.5.48 Mar 2021

Nothing published for this version

0.5.318 Feb 2021

Nothing published for this version

0.5.227 Jan 2021

Nothing published for this version

0.5.127 Nov 2020

Nothing published for this version

0.5.019 Nov 2020

Nothing published for this version

0.4.1623 Jun 2020

Nothing published for this version

0.4.146 Feb 2020

Nothing published for this version

0.4.1313 Nov 2018

Nothing published for this version

0.4.1112 May 2018

Nothing published for this version

0.4.1012 May 2018

Nothing published for this version

0.4.925 Apr 2018

Nothing published for this version

0.4.823 Apr 2018

Nothing published for this version

0.4.79 Feb 2015

Nothing published for this version

0.4.69 Feb 2015

Nothing published for this version

0.4.59 Feb 2015

Nothing published for this version

0.4.44 Feb 2014

Nothing published for this version

0.4.311 Apr 2013

Nothing published for this version

0.2.14 Mar 2013

Nothing published for this version

0.2.026 Feb 2013

Nothing published for this version

0.1.95 Nov 2012

Nothing published for this version

0.1.811 Oct 2012

Nothing published for this version

0.1.729 Sept 2012

Nothing published for this version

0.1.629 Sept 2012

Nothing published for this version

0.1.53 Aug 2012

Nothing published for this version

0.1.43 Aug 2012

Nothing published for this version

0.1.312 Mar 2012

Nothing published for this version

0.1.228 Feb 2012

Nothing published for this version

0.1.123 Feb 2012

Nothing published for this version

Your coding agent can read these notes before it upgrades. Set up the MCP server →