Advisory Database
  • Advisories
  • Dependency Scanning
  1. npm
  2. ›
  3. fflate
  4. ›
  5. CVE-2026-45820

CVE-2026-45820: fflate unzipSync can enter an infinite loop when parsing malformed ZIP64 archives

July 22, 2026 (updated September 3, 2026)

fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring compressed_size=0xFFFFFFFF (ZIP64 sentinel) but missing the required ZIP64 extra field tag 0x0001 causes z64e() to loop indefinitely due to out-of-bounds reads returning undefined, which coerces to 0, keeping the loop condition permanently true.

References

  • github.com/101arrowz/fflate/blob/f7873560ad229c22c4b23b06c6a3806ffde77569/src/index.ts
  • github.com/101arrowz/fflate/commit/e6d5e6e1076892f72770ac732d83c81da9f3316e
  • github.com/101arrowz/fflate/releases/tag/v0.8.3
  • github.com/advisories/GHSA-px8p-9vwx-vf98
  • nvd.nist.gov/vuln/detail/CVE-2026-45820

Code Behaviors & Features

Detect and mitigate CVE-2026-45820 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions starting from 0.4.5 before 0.4.9, all versions starting from 0.5.0 before 0.5.4, all versions starting from 0.6.0 before 0.6.11, all versions starting from 0.7.0 before 0.7.5, all versions starting from 0.8.0 before 0.8.3

Fixed versions

  • 0.4.9
  • 0.5.4
  • 0.6.11
  • 0.7.5
  • 0.8.3

Solution

Upgrade to versions 0.4.9, 0.5.4, 0.6.11, 0.7.5, 0.8.3 or above.

Impact 7.5 HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Learn more about CVSS

Weakness

  • CWE-400: Uncontrolled Resource Consumption

Source file

npm/fflate/CVE-2026-45820.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Tue, 22 Sep 2026 12:22:07 +0000.