Skip to content
CVE PROGRAM SOURCE RECORD6.6 Medium

CVE-2026-45820

fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring compressed_size=0xFFFFFF

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
seal

Description

fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring compressed_size=0xFFFFFFFF (ZIP64 sentinel) but missing the required ZIP64 extra field tag 0x0001 causes z64e() to loop indefinitely due to out-of-bounds reads returning undefined, which coerces to 0, keeping the loop condition permanently true.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

101arrowz fflate

Default version status: unaffected

  • 0.4.5 to ≤ 0.4.8affected
  • 0.5.0 to ≤ 0.5.3affected
  • 0.6.0 to ≤ 0.6.10affected
  • 0.7.0 to ≤ 0.7.4affected
  • 0.8.0 to ≤ 0.8.2affected

References