CVE-2026-45820
Reported by seal · Published July 22, 2026
fflate is fixed in 0.8.3, 0.7.5, 0.6.11 and 2 more (npm)
fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring compressed_size=0xFFFFFFFF (ZIP64 sentinel) but missing the required ZIP64 extra field tag 0x0001 causes z64e() to loop indefinitely due to out-of-bounds reads returning undefined, which coerces to 0, keeping the loop condition permanently true.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| fflate | npm | 0.8.3, 0.7.5, 0.6.11, 0.5.4, 0.4.9 |
| langfuse-fips-3 | Chainguard | 3.225.7-r1 |
| langfuse-fips-4 | Chainguard | 4.28.1-r1 |
| commercial-gitlab-rails-ee-19.3 | Chainguard | 19.3.3-r1 |
| lambda-nodejs | Chainguard | 4.0.2-r2 |
| commercial-gitlab-rails-ee-fips-19.2 | Chainguard | 19.2.7-r1 |
| librechat | Chainguard | 0.8.7-r12 |
| commercial-gitlab-rails-ee-19.2 | Chainguard | 19.2.7-r1 |
| langfuse-3 | Wolfi | 3.225.7-r6, 3.225.7-r2 |
| langfuse-4 | Chainguard | 4.27.0-r4 |
| langfuse-3 | Chainguard | 3.225.7-r6, 3.225.7-r2 |
| tileserver-gl-fips | Chainguard | 5.6.0-r15 |
6 more packages have a fixed version. See every fix in Lookup.
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| 101arrowz | fflate | 0.4.5, 0.5.0, 0.6.0 |
| npm | fflate | 0.5.0, 0.8.0, 0.7.0 |
| chainguard | langfuse-fips-3 | 0 |
| chainguard | langfuse-fips-4 | 0 |
| chainguard | commercial-gitlab-rails-ee-19.3 | 0 |
| chainguard | lambda-nodejs | 0 |
| chainguard | commercial-gitlab-rails-ee-fips-19.2 | 0 |
| chainguard | librechat | 0 |
| chainguard | commercial-gitlab-rails-ee-19.2 | 0 |
| 101arrowz | fflate | 0.8.0, 0.4.5, 0.5.0 |
| wolfi | langfuse-3 | 0, 0 |
| chainguard | langfuse-4 | 0 |
| chainguard | langfuse-3 | 0, 0 |
| chainguard | tileserver-gl-fips | 0 |
| chainguard | commercial-gitlab-rails-ee-fips-19.1 | 0 |
| chainguard | commercial-gitlab-rails-ee-19.1 | 0 |
| chainguard | commercial-gitlab-rails-ee-fips-19.3 | 0 |
| wolfi | tileserver-gl | 0 |
| chainguard | tileserver-gl | 0 |
Timeline
- Jul 22, 2026 CVE Published
- Jul 22, 2026 EPSS Score (24 in total, the first dated here)
- Jul 22, 2026 Coalition ESS Score
- Sep 3, 2026 CVE Updated
- Sep 10, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-45820
vulnetix vdb fixes CVE-2026-45820Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-45820/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart