Skip to content
CVE Tracker
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2026-45820

fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central…

Medium6.6EPSS 0.28%
Published
Updated
Reserved
Assigned by
seal

Description

fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring compressed_size=0xFFFFFFFF (ZIP64 sentinel) but missing the required ZIP64 extra field tag 0x0001 causes z64e() to loop indefinitely due to out-of-bounds reads returning undefined, which coerces to 0, keeping the loop condition permanently true.

Scores

CVSS scores of CVE-2026-45820, by who scored it
Scored byCVSSScoreVector
sealCNA (assigner)4.0Medium6.6CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/S:N/AU:Y/R:U/V:D/RE:M/U:Amber
NVDNVD · Analyzed4.0Medium6.6CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber
EPSS (exploitation in 30 days)
0.28% · top 80% of all CVEs (6 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: yes · Technical impact: partial
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.6.

Weakness

Affected products

  • 101arrowz · fflate

    • affected 0.4.5 – ≤ 0.4.8
    • affected 0.5.0 – ≤ 0.5.3
    • affected 0.6.0 – ≤ 0.6.10
    • affected 0.7.0 – ≤ 0.7.4
    • affected 0.8.0 – ≤ 0.8.2

Affected packages

From reviewed advisories of the GitHub Advisory Database.

References (2)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2026-45820 badge
[![CVE-2026-45820](https://trackcve.app/badge/CVE-2026-45820.svg)](https://trackcve.app/cve/CVE-2026-45820)

Record last updated .