CVE-2026-45820
1 advisory.
npm/fflate CVE-2026-45820: high 7.5
fflate unzipSync can enter an infinite loop when parsing malformed ZIP64 archives
Action: Upgrade fflate to 0.4.9 or later.
npm i fflate@0.4.9npm i fflate@0.5.4npm i fflate@0.6.11npm i fflate@0.7.5npm i fflate@0.8.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.4.5 | 0.4.9 | - |
| 0.5.0 | 0.5.4 | - |
| 0.6.0 | 0.6.11 | - |
| 0.7.0 | 0.7.5 | - |
| 0.8.0 | 0.8.3 | - |
Fixed versions
| 0.4.9 | 0.5.4 | 0.6.11 | 0.7.5 | 0.8.3 |
Sources
- osv: GHSA-px8p-9vwx-vf98
- https://nvd.nist.gov/vuln/detail/CVE-2026-45820
- https://github.com/101arrowz/fflate/commit/e6d5e6e1076892f72770ac732d83c81da9f3316e
- https://github.com/101arrowz/fflate
- https://github.com/101arrowz/fflate/blob/f7873560ad229c22c4b23b06c6a3806ffde77569/src/index.ts#L2714
- https://github.com/101arrowz/fflate/releases/tag/v0.8.3
CVE-2026-45820 · published · modified · JSON