CVE-2026-45820 Details
Description
fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring compressed_size=0xFFFFFFFF (ZIP64 sentinel) but missing the required ZIP64 extra field tag 0x0001 causes z64e() to loop indefinitely due to out-of-bounds reads returning undefined, which coerces to 0, keeping the loop condition permanently true.
A denial-of-service vulnerability has been identified in the fflate library, affecting versions through 0.8.2. The issue arises in the unzipSync() function, where a crafted ZIP archive can cause an infinite loop. This occurs when the central directory entry of the ZIP file declares a compressed size of 0xFFFFFFFF (indicating a ZIP64 sentinel) but lacks the necessary ZIP64 extra field tag 0x0001. As a result, the z64e() function enters a perpetual loop, driven by out-of-bounds reads that return undefined values. These undefined values coerce to 0, creating a loop condition that remains permanently true.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/101arrowz/fflate/blob/f7873560ad229c22c4b23b06c6a3806ffde77569/src/index.ts#L2714 | seal | Patch |
| https://www.npmjs.com/package/fflate | seal | Product |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | seal |
| CWE-835 | Loop with Unreachable Exit Condition ('Infinite Loop') | seal |
Affected Products
| Product | Versions |
|---|---|
| 101arrowz fflate | <= 0.8.2 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 19, 2026 | Initial Analysis | [email protected] |
| Jul 22, 2026 | CVE Modified | CISA-ADP |
| Jul 22, 2026 | New CVE Received | seal |