1vulnerability
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate1 (100.0%)
- Low0 (0.0%)
fflate
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 1ModerateAffects 5 versions
- 0LowAffects 0 versions
Monthly breakdown
- 1 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 1
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting fflate, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-px8p-9vwx-vf98 | Moderate | fflate unzipSync can enter an infinite loop when parsing malformed ZIP64 archivesfflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring compressed_size=0xFFFFFFFF (ZIP64 sentinel) but missing the required ZIP64 extra field tag 0x0001 causes z64e() to loop indefinitely due to out-of-bounds reads returning undefined, which coerces to 0, keeping the loop condition permanently true. |
| GitHub (opens in a new tab) |
- GHSA-px8p-9vwx-vf98Moderatefflate unzipSync can enter an infinite loop when parsing malformed ZIP64 archives
>= 0.4.5, < 0.4.9>= 0.5.0, < 0.5.4- +3 more
Affected versions:>= 0.4.5, < 0.4.9>= 0.5.0, < 0.5.4>= 0.6.0, < 0.6.11>= 0.7.0, < 0.7.5>= 0.8.0, < 0.8.3
fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring compressed_size=0xFFFFFFFF (ZIP64 sentinel) but missing the required ZIP64 extra field tag 0x0001 causes z64e() to loop indefinitely due to out-of-bounds reads returning undefined, which coerces to 0, keeping the loop condition permanently true.
CVE: CVE-2026-45820