DDoS via infinite loop in fflate <0.8.3 unzipSync()
CVE-2026-45820 Published on July 22, 2026
fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring compressed_size=0xFFFFFFFF (ZIP64 sentinel) but missing the required ZIP64 extra field tag 0x0001 causes z64e() to loop indefinitely due to out-of-bounds reads returning undefined, which coerces to 0, keeping the loop condition permanently true.
Weakness Types
What is an Infinite Loop Vulnerability?
The program contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop. If the loop can be influenced by an attacker, this weakness could allow attackers to consume excessive resources such as CPU or memory.
CVE-2026-45820 has been classified to as an Infinite Loop vulnerability or weakness.
What is a Resource Exhaustion Vulnerability?
The software does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVE-2026-45820 has been classified to as a Resource Exhaustion vulnerability or weakness.
Affected Versions
101arrowz fflate:- Version 0.4.5, <= 0.4.8 is affected.
- Version 0.5.0, <= 0.5.3 is affected.
- Version 0.6.0, <= 0.6.10 is affected.
- Version 0.7.0, <= 0.7.4 is affected.
- Version 0.8.0, <= 0.8.2 is affected.