zlib: harden ZIP archive reading and writing against malicious input - #65016

Closed

pipobscure wants to merge 6 commits into

nodejs:mainfrom

pipobscure:zip-security-fixes

Commits on Aug 10, 2026

test: cover ZIP header-confusion and DoS guards
pipobscure
committed
19c48a5
zlib: reject local/central ZIP header mismatch
pipobscure
committed
adf232f
zlib: do not hang archiving a FIFO or device
pipobscure
committed
31ace3f
test: cover ZIP fd lifecycle and add rollback
pipobscure
committed
bee84c6
zlib: let a ZipFile read finish before close()
pipobscure
committed
b41df04
zlib: roll back a failed add() directory rewrite
pipobscure
committed
0729e5c