CVE-2026-45820

Name of the Vulnerable Software and Affected Versions fflate versions prior to 0.8.3

Description A denial of service occurs due to an infinite loop in the unzipSync() function. This happens when processing a specially crafted ZIP archive where a central directory entry declares compressed size as 0xFFFFFFFF (a ZIP64 sentinel) but lacks the mandatory ZIP64 extra field tag 0x0001. This configuration causes the z64e() function to loop indefinitely because out-of-bounds reads return undefined, which is coerced to 0, maintaining a true loop condition.

Recommendations Update fflate to version 0.8.3 or later. As a temporary mitigation, avoid using the unzipSync() function to process untrusted ZIP archives.