VDB
CVE-2026-45820
CVE-2026-45820
PUBLISHED
CVSS 6.6 MEDIUM
Reported by seal · Published July 22, 2026
fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring compressed_size=0xFFFFFFFF (ZIP64 sentinel) but missing the required ZIP64 extra field tag 0x0001 causes z64e() to loop indefinitely due to out-of-bounds reads returning undefined, which coerces to 0, keeping the loop condition permanently true.
Risk Scores
CVSS 4.0
6.6
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/S:N/AU:Y/R:U/V:D/RE:M/U:Amber
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| 101arrowz | fflate | 0.4.5, 0.5.0, 0.6.0 |
| npm | fflate | 0.8.0, 0.7.0, 0.6.0 |
| chainguard | langfuse-fips-3 | 0 |
| chainguard | langfuse-fips-4 | 0 |
| chainguard | commercial-gitlab-rails-ee-19.3 | 0 |
| chainguard | lambda-nodejs | 0 |
| chainguard | commercial-gitlab-rails-ee-fips-19.2 | 0 |
| chainguard | librechat | 0 |
| chainguard | commercial-gitlab-rails-ee-19.2 | 0 |
| 101arrowz | fflate | 0.8.0, 0.4.5, 0.5.0 |
| wolfi | langfuse-3 | 0, 0 |
| chainguard | langfuse-4 | 0 |
| chainguard | langfuse-3 | 0, 0 |
| chainguard | tileserver-gl-fips | 0 |
| chainguard | commercial-gitlab-rails-ee-19.1 | 0 |
| chainguard | commercial-gitlab-rails-ee-fips-19.3 | 0 |
| wolfi | tileserver-gl | 0 |
| chainguard | tileserver-gl | 0 |
Timeline
- Jul 22, 2026 CVE Published
- Jul 22, 2026 EPSS Score
- Jul 22, 2026 Coalition ESS Score
- Aug 7, 2026 EPSS Score
- Aug 24, 2026 EPSS Score
- Aug 28, 2026 EPSS Score
- Sep 3, 2026 CVE Updated
- Sep 4, 2026 EPSS Score
- Sep 9, 2026 EPSS Score
- Sep 10, 2026 Security Advisory
- Sep 12, 2026 EPSS Score
- Sep 16, 2026 EPSS Score