CVE-2026-45820

State: Published
Severity: 6.6 Medium
Published: Jul 22, 2026
Updated: Jul 22, 2026
Reserved: May 13, 2026

Description

fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring compressed_size=0xFFFFFFFF (ZIP64 sentinel) but missing the required ZIP64 extra field tag 0x0001 causes z64e() to loop indefinitely due to out-of-bounds reads returning undefined, which coerces to 0, keeping the loop condition permanently true.

Scores

CVSS	Score	Vector	Source
4.0	6.6 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/S:N/AU:Y/R:U/V:D/RE:M/U:Amber	seal

Weaknesses

CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
CWE-400 Uncontrolled Resource Consumption

Affected Products

Product	Versions
fflate101arrowz	0.4.5 through 0.4.8Affected 0.5.0 through 0.5.3Affected 0.6.0 through 0.6.10Affected 0.7.0 through 0.7.4Affected 0.8.0 through 0.8.2Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.