CVE-2026-45820: fflate Infinite Loop Vulnerability in unzipSync Function
Summary
CVE-2026-45820: fflate unzipSync can enter an infinite loop when parsing malformed ZIP64 archives. Affects fflate across 5 version ranges.
>= 0.4.5, < 0.4.9
>= 0.5.0, < 0.5.4
>= 0.6.0, < 0.6.11
>= 0.7.0, < 0.7.5
>= 0.8.0, < 0.8.3
Fixed in 5 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
fflate is a high-performance compression and decompression library for JavaScript, primarily used for handling ZIP files. It is designed to be lightweight and efficient, making it popular among developers for managing compressed data in web applications. However, certain versions of fflate are vulnerable to a denial of service attack due to improper handling of malformed ZIP64 archives, which can lead to infinite loops during the extraction process.
Vulnerability Detail
The vulnerability arises in the unzipSync() function of fflate versions up to 0.8.2. When a specially crafted ZIP archive is processed, it can trigger an infinite loop if the central directory entry indicates a compressed size of 0xFFFFFFFF (the ZIP64 sentinel) but lacks the necessary ZIP64 extra field tag (0x0001). This results in out-of-bounds reads that return undefined values, causing the loop condition to remain perpetually true, leading to a denial of service.
How To Fix
Latest published version: 0.8.3 as of 22 Oct 2026
npm install fflate@0.8.3The newest release already contains this fix.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 0.4.5, < 0.4.90.4.9npm install fflate@0.4.9 -
>= 0.5.0, < 0.5.40.5.4npm install fflate@0.5.4 -
>= 0.6.0, < 0.6.110.6.11npm install fflate@0.6.11 -
>= 0.7.0, < 0.7.50.7.5npm install fflate@0.7.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid processing ZIP files that may be malformed or ensure that your application validates ZIP files before attempting to extract them. Implementing checks for the presence of the ZIP64 extra field tag can help mitigate the risk of encountering this vulnerability.
Conclusion
The fflate library has a significant vulnerability that can lead to denial of service through an infinite loop when processing malformed ZIP64 archives. It is crucial for developers using affected versions to update to the patched versions to ensure the security and stability of their applications. Utilizing tools like Vulert can help in monitoring and managing such vulnerabilities effectively.
See every vulnerability recorded for fflate →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a moderate severity level.
fflate versions up to and including 0.8.2 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By checking your package-lock.json file, Vulert can identify if your application is affected by this vulnerability.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If immediate updates are not possible, ensure that you validate ZIP files before processing them to avoid triggering the infinite loop.
