CVE-2026-45820: fflate unzipSync can enter an infinite loop when parsing malformed ZIP64 archives

July 22, 2026 (updated September 3, 2026)

fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring compressed_size=0xFFFFFFFF (ZIP64 sentinel) but missing the required ZIP64 extra field tag 0x0001 causes z64e() to loop indefinitely due to out-of-bounds reads returning undefined, which coerces to 0, keeping the loop condition permanently true.

References

github.com/101arrowz/fflate/blob/f7873560ad229c22c4b23b06c6a3806ffde77569/src/index.ts
github.com/101arrowz/fflate/commit/e6d5e6e1076892f72770ac732d83c81da9f3316e
github.com/101arrowz/fflate/releases/tag/v0.8.3
github.com/advisories/GHSA-px8p-9vwx-vf98
nvd.nist.gov/vuln/detail/CVE-2026-45820

Code Behaviors & Features

Detect and mitigate CVE-2026-45820 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →