CVE-2026-45820Published
fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring compressed_size=0xFFFFFFFF (ZIP64 sentinel) but missing the required ZIP64 extra fie…
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-45820 · Microsoft / collected KEV context
cve-program · CVE-2026-45820
- https://github.com/101arrowz/fflate/blob/f7873560ad229c22c4b23b06c6a3806ffde77569/src/index.ts#L2714
- https://www.npmjs.com/package/fflate
euvd · EUVD-2026-47616
- https://github.com/101arrowz/fflate/blob/f7873560ad229c22c4b23b06c6a3806ffde77569/src/index.ts#L2714
- https://www.npmjs.com/package/fflate
nvd · CVE-2026-45820
- https://github.com/101arrowz/fflate/blob/f7873560ad229c22c4b23b06c6a3806ffde77569/src/index.ts#L2714
- https://www.npmjs.com/package/fflate
osv · GHSA-px8p-9vwx-vf98
- https://nvd.nist.gov/vuln/detail/CVE-2026-45820
- https://github.com/101arrowz/fflate/commit/e6d5e6e1076892f72770ac732d83c81da9f3316e
- https://github.com/101arrowz/fflate
- https://github.com/101arrowz/fflate/blob/f7873560ad229c22c4b23b06c6a3806ffde77569/src/index.ts#L2714
- https://github.com/101arrowz/fflate/releases/tag/v0.8.3
Related operational evidence
Explicit CVE identifiers- fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring compressed_size=0xFFFFFFFF (ZIP64 sentinel) but missing the required ZIP64 extra fie… · Advisory content revised · 5 Nov 2026
- fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring compressed_size=0xFFFFFFFF (ZIP64 sentinel) but missing the required ZIP64 extra fie… · Advisory content revised · 1 Nov 2026