GHSA-rcw4-f5rp-g42v: adm-zip: Decompression-bomb protection (fix for CVE-2026-39244) can be bypassed by declaring uncompressed size as 0

The fix shipped for CVE-2026-39244 (methods/inflater.js) caps zlib’s decompression output via maxOutputLength: expectedLength, where expectedLength is read directly from the ZIP entry’s attacker-controlled “uncompressed size” header field (CENLEN/LOCLEN). This cap is only applied when expectedLength > 0:

const option = version >= 15 && expectedLength > 0 ? { maxOutputLength: expectedLength } : {};
return zlib.inflateRawSync(inbuf, option);

If an attacker sets the declared uncompressed-size field to exactly 0, this condition is false, option becomes {}, and no output cap is passed to zlib at all. Node then falls back to zlib’s own internal default limit (several GB), so a small, highly-compressible payload can still be decompressed to a very large size in memory – the same class of resource-exhaustion issue the original CVE addressed, just triggered differently.