CVE-2026-45820: Medium severity npm/fflate vulnerability
fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring compressedsize=0xFFFFFFFF (ZIP64 sentinel) but missing the required ZIP64 extra field tag 0x0001 causes z64e() to loop indefinitely due to out-of-bounds reads returning undefined, which coerces to 0, keeping the loop condition permanently true.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45820?
CVE-2026-45820 has a medium severity rating of 6.6 according to the CVSS score.
How do I fix CVE-2026-45820?
To fix CVE-2026-45820, upgrade to the latest version of the fflate library that addresses the denial of service vulnerability.
What type of vulnerability is CVE-2026-45820?
CVE-2026-45820 is classified as a denial of service vulnerability caused by an infinite loop in the unzipSync() function.
What software is affected by CVE-2026-45820?
CVE-2026-45820 affects the fflate library in the npm package ecosystem.
What conditions trigger the vulnerability in CVE-2026-45820?
The vulnerability in CVE-2026-45820 is triggered by a specially crafted ZIP archive that declares a large compressed size without the required ZIP64 extra field.