En bref
- CVE-2026-45820 est une vulnérabilité ÉLEVÉE (CVSS 7.5) touchant fflate (101arrowz), fflate.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.28%, plus élevée que 20.4% des vulnérabilités.
- Correctif : mettre à jour vers 0.4.9, 0.5.4, 0.6.11, 0.7.5 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| fflate | ≤ 0.8.2
| No fix yet |
| fflate npm | ≥ 0.4.5, < 0.4.9≥ 0.5.0, < 0.5.4≥ 0.6.0, < 0.6.11≥ 0.7.0, < 0.7.5≥ 0.8.0, < 0.8.3
| 0.4.90.5.40.6.110.7.50.8.3
|
Description
fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring compressed_size=0xFFFFFFFF (ZIP64 sentinel) but missing the required ZIP64 extra field tag 0x0001 causes z64e() to loop indefinitely due to out-of-bounds reads returning undefined, which coerces to 0, keeping the loop condition permanently true.
NVD description
fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring compressed_size=0xFFFFFFFF (ZIP64 sentinel) but missing the required ZIP64 extra field tag 0x0001 causes z64e() to loop indefinitely due to out-of-bounds reads returning undefined, which coerces to 0, keeping the loop condition permanently true.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free