decompression-bomb

Decompression Bomb Detection

When to Use

Audit archive/compression libraries, file upload handlers, content-encoding processors, and any package that decompresses user-supplied data.

Key Insight

Buffer-based decompression is vulnerable: the entire decompressed output is loaded into memory at once. A 1KB compressed payload can expand to 1GB+.

Stream-based MAY have backpressure: but only if the consumer applies it. Many stream implementations still buffer the entire output.

Process

Step 1: Find Decompression Sinks

# JavaScript
grep -rn "zlib\.gunzip\|zlib\.inflate\|zlib\.unzip\|zlib\.brotli" .
grep -rn "gunzipSync\|inflateSync\|unzipSync\|brotliDecompress" .
grep -rn "pako\|fflate\|lz-string\|snappy" .
grep -rn "decompress\|decompressSync\|uncompress" .

# Python
grep -rn "zlib\.decompress\|gzip\.decompress\|bz2\.decompress" .
grep -rn "lzma\.decompress\|snappy\.decompress" .

# Go
grep -rn "gzip\.NewReader\|zlib\.NewReader\|flate\.NewReader" .
grep -rn "compress/gzip\|compress/zlib\|compress/flate" .

Step 2: Check for Size Limits

grep -rn "maxSize\|maxOutput\|maxLength\|MAX_SIZE\|outputLimit\|sizeLimit" .
grep -rn "ratio\|compressionRatio\|maxRatio" .

Step 3: Check Buffer vs Stream

Buffer-based (VULNERABLE):

zlib.gunzipSync(input)                    // Entire output in memory
zlib.gunzip(input, (err, result) => {})   // Callback with full buffer

Stream-based (CHECK):

input.pipe(zlib.createGunzip()).pipe(output)  // Streaming, may have backpressure

Even stream-based can be vulnerable if:

• Output is collected into a buffer: const chunks = []; stream.on('data', c => chunks.push(c))
• No backpressure is applied
• Consumer reads faster than it can process

Step 4: Verify Exploitability

1. Can the attacker supply compressed data? (file upload, HTTP content-encoding, archive processing)
2. Is there an input size limit that would prevent the bomb?
3. Is there a decompressed size limit?
4. Is the process memory-limited?