CVE-2026-45820 fflate unzipSync can enter an infinite loop when parsing malformed ZIP64 archives
Attackers can cause a denial of service in applications using fflate by providing a crafted ZIP archive that triggers an infinite loop during decompression.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-45820?
CVE-2026-45820 is a medium-severity denial of service vulnerability in 101arrowz fflate, published on 22 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring compressed_size=0xFFFFFFFF (ZIP64 sentinel) but missing the required ZIP64 extra field tag 0x0001 causes z64e() to loop indefinitely due to out-of-bounds reads returning undefined, which coerces to 0, keeping the loop condition permanently true.
Which versions are affected by CVE-2026-45820?
10 open source packages ship an affected version, including fflate. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
fflate npm | From 0.4.5 | 0.4.9 |
fflate npm | From 0.4.5 | 0.4.9 |
fflate npm | From 0.5.0 | 0.5.4 |
fflate npm | From 0.5.0 | 0.5.4 |
fflate npm | From 0.6.0 | 0.6.11 |
fflate npm | From 0.6.0 | 0.6.11 |
4 more packages
fflate npm | From 0.7.0 | 0.7.5 |
fflate npm | From 0.7.0 | 0.7.5 |
fflate npm | From 0.8.0 | 0.8.3 |
fflate npm | From 0.8.0 | 0.8.3 |
Products include 101arrowz Fflate.
How do I fix CVE-2026-45820?
Upgrade fflate to a fixed version for your release line: 0.4.9, 0.5.4, 0.6.11 or 0.7.5.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-45820 being exploited?
There is no known exploitation of CVE-2026-45820 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-DF16083, CLEANSTART-2026-DW46246, CLSA-2026-1789897715, CLSA-2026-1790161290, ECHO-3bcd-0586-7ae3, GHSA-px8p-9vwx-vf98 and 12 more.