Kurz gesagt
- CVE-2026-45820 ist eine Schwachstelle (HOCH (CVSS 7.5)) in fflate (101arrowz), fflate.
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.28%, höher als bei 20.4% aller Schwachstellen.
- Abhilfe: auf 0.4.9, 0.5.4, 0.6.11, 0.7.5 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| fflate | ≤ 0.8.2
| No fix yet |
| fflate npm | ≥ 0.4.5, < 0.4.9≥ 0.5.0, < 0.5.4≥ 0.6.0, < 0.6.11≥ 0.7.0, < 0.7.5≥ 0.8.0, < 0.8.3
| 0.4.90.5.40.6.110.7.50.8.3
|
Description
fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring compressed_size=0xFFFFFFFF (ZIP64 sentinel) but missing the required ZIP64 extra field tag 0x0001 causes z64e() to loop indefinitely due to out-of-bounds reads returning undefined, which coerces to 0, keeping the loop condition permanently true.
NVD description
fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring compressed_size=0xFFFFFFFF (ZIP64 sentinel) but missing the required ZIP64 extra field tag 0x0001 causes z64e() to loop indefinitely due to out-of-bounds reads returning undefined, which coerces to 0, keeping the loop condition permanently true.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free