CVE-2026-45820 in fflate
Summary
by MITRE • 07/22/2026
fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring compressed_size=0xFFFFFFFF (ZIP64 sentinel) but missing the required ZIP64 extra field tag 0x0001 causes z64e() to loop indefinitely due to out-of-bounds reads returning undefined, which coerces to 0, keeping the loop condition permanently true.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
The vulnerability in fflate library versions through 0.8.2 represents a critical denial of service weakness that can be exploited through malformed ZIP archive processing. This issue specifically affects the unzipSync() function which handles decompression operations, creating a scenario where maliciously crafted ZIP files can cause indefinite looping behavior in the decompression process.
The technical flaw stems from improper validation of ZIP64 central directory entries within the z64e() function implementation. When a ZIP archive contains a central directory entry with compressed_size set to 0xFFFFFFFF (the ZIP64 sentinel value) without including the mandatory ZIP64 extra field tag 0x0001, the decompression logic enters an infinite loop. This occurs because the out-of-bounds read operations return undefined values that are subsequently coerced to zero, maintaining the loop condition indefinitely.
This vulnerability operates at the boundary between legacy and extended ZIP format specifications, where the ZIP64 standard requires specific extra field tags to be present when using the sentinel values. The absence of proper validation allows the decompression algorithm to process malformed entries without termination, consuming excessive system resources and potentially causing application crashes or system unresponsiveness.
From a cybersecurity perspective, this vulnerability aligns with CWE-835, which addresses infinite loops in software implementations that can lead to denial of service conditions. The issue demonstrates how seemingly minor parsing inconsistencies can create significant operational risks when processing untrusted data formats. The ATT&CK framework categorizes this under T1499.004 for network denial of service through resource exhaustion.
The operational impact extends beyond simple application crashes, as this vulnerability can affect any system or application that relies on fflate for ZIP file processing. Attackers can craft malicious archives that specifically target this weakness, potentially causing cascading failures in systems that process user-uploaded content or automated ZIP extraction workflows. The infinite loop consumes CPU resources continuously until manually terminated or system resources are exhausted.
Mitigation strategies should focus on immediate library updates to versions that address the parsing inconsistency, along with implementing input validation measures that check for malformed ZIP64 entries before processing. Organizations should also consider implementing resource limits and timeouts during decompression operations to prevent exploitation from causing system-wide disruptions. Additionally, proper error handling and graceful degradation mechanisms should be implemented to ensure that malformed inputs do not cause complete system failures, aligning with secure coding practices outlined in industry standards for robust software development.
The vulnerability highlights the importance of comprehensive testing against edge cases and malformed data inputs, particularly when implementing file format parsers that must handle multiple specification versions. Regular security audits of third-party libraries and maintaining up-to-date dependencies remain critical defensive measures against such implementation-level weaknesses that can be exploited to cause operational disruptions.