{"id":"GHSA-px8p-9vwx-vf98","revision":"ed75a91041a34e3a901de8a1bb373018","records":[{"revision":"ed75a91041a34e3a901de8a1bb373018","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-px8p-9vwx-vf98","aliases":["CVE-2026-45820"],"title":"fflate unzipSync can enter an infinite loop when parsing malformed ZIP64 archives","description":"fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring compressed_size=0xFFFFFFFF (ZIP64 sentinel) but missing the required ZIP64 extra field tag 0x0001 causes z64e() to loop indefinitely due to out-of-bounds reads returning undefined, which coerces to 0, keeping the loop condition permanently true.","state":0,"publishedAt":"2026-07-22T09:32:13+00:00","modifiedAt":"2026-09-10T03:50:52.7587923+00:00","affected":[{"ecosystem":"npm","name":"fflate","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.4.5"},{"kind":"fixed","version":"0.4.9"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"fflate","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.5.0"},{"kind":"fixed","version":"0.5.4"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"fflate","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.6.0"},{"kind":"fixed","version":"0.6.11"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"fflate","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.7.0"},{"kind":"fixed","version":"0.7.5"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"fflate","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.8.0"},{"kind":"fixed","version":"0.8.3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2026-45820","https://github.com/101arrowz/fflate/commit/e6d5e6e1076892f72770ac732d83c81da9f3316e","https://github.com/101arrowz/fflate","https://github.com/101arrowz/fflate/blob/f7873560ad229c22c4b23b06c6a3806ffde77569/src/index.ts#L2714","https://github.com/101arrowz/fflate/releases/tag/v0.8.3"],"sourceUrl":"https://github.com/advisories/GHSA-px8p-9vwx-vf98","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-px8p-9vwx-vf98","identifiers":["GHSA-px8p-9vwx-vf98","CVE-2026-45820"]},"retained":false,"historicalAffected":[]}],"coverage":[]}