CVE-2026-45820

HighCVSS 7.5

Published: 22/07/2026(UTC)Updated: 24/10/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

20th percentile - higher than 20% of all known CVEs

Summary

The fflate library up to version 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with compressed_size=0xFFFFFFFF (ZIP64 sentinel) without the required ZIP64 extra field causes an infinite loop due to out-of-bounds reads.

Risk Assessment

The risk is potential blocking of applications using fflate for decompression, leading to denial of service.

Recommendation

Upgrade fflate to version 0.8.3 or later. As a workaround, avoid decompressing untrusted ZIP archives.

Other vulnerabilities in fflate

CVE-2026-122146High
A weakness has been identified in the fflate library up to version 0.8.3, affecting the unzipSync function in esm/index.mjs. The manipulation causes memory corruption and can be triggered remotely. The exploit has been publicly disclosed and the vendor did not respond to the report.

Original NVD description (English source)

fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring compressed_size=0xFFFFFFFF (ZIP64 sentinel) but missing the required ZIP64 extra field tag 0x0001 causes z64e() to loop indefinitely due to out-of-bounds reads returning undefined, which coerces to 0, keeping the loop condition permanently true.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS