CVE-2026-45820

High

Description

fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring compressed_size=0xFFFFFFFF (ZIP64 sentinel) but missing the required ZIP64 extra field tag 0x0001 causes z64e() to loop indefinitely due to out-of-bounds reads returning undefined, which coerces to 0, keeping the loop condition permanently true.

SeverityHigh

CVSS7.5

Exploit probability—

Product101arrowz Fflate

PublishedJul 22, 2026

First seenJul 22, 2026

Weakness typeCWE-835CWE-835 CWE-400Uncontrolled resource consumption

How to fix

Update

fflate0.4.9, 0.5.4, 0.6.11, 0.7.5, 0.8.3 or later

Affected products

Product	Affected versions	Fixed in
101arrowz fflate	v ≤ 0.8.2	—
fflatenpm	0.4.5 ≤ v < 0.4.9, 0.5.0 ≤ v < 0.5.4, 0.6.0 ≤ v < 0.6.11, 0.7.0 ≤ v < 0.7.5, 0.8.0 ≤ v < 0.8.3	0.4.9, 0.5.4, 0.6.11, 0.7.5, 0.8.3

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.