Denial of Service in fflate Library by 101arrowz

CVE-2026-45820

What is CVE-2026-45820?

The fflate library version 0.8.2 is susceptible to a denial of service attack due to a flaw in the unzipSync() function. An attacker can exploit this vulnerability by crafting a ZIP archive with a central directory entry that declares a compressed size of 0xFFFFFFFF, without including the necessary ZIP64 extra field tag (0x0001). This leads to an infinite loop in the z64e() function, which performs out-of-bounds reads that yield undefined behaviors and coerces the loop condition to remain perpetually true, resulting in resource exhaustion and a potential service outage.

References