Executive brief
fflate is a JavaScript compression/decompression library used in many web applications. The unzipSync function can be forced to hang indefinitely (entering an infinite loop) when processing a specially-crafted ZIP file with malformed ZIP64 headers. An attacker can exploit this by uploading or serving a malicious ZIP file, causing any application using fflate to become unresponsive and deny service to legitimate users.
Technical details
The vulnerability is a denial-of-service via uncontrolled resource consumption (CWE-400) in the ZIP64 extra field parsing logic. When unzipSync() processes a ZIP archive with a compressed_size field set to 0xFFFFFFFF (the ZIP64 sentinel), it expects a ZIP64 extra field (tag 0x0001) to contain the actual size. However, if this extra field is missing or malformed, the z64e() parsing function performs out-of-bounds reads on the buffer; these return undefined in JavaScript, which coerces to 0. Since the loop condition checks if the byte value equals 0, the condition remains permanently true, creating an infinite loop that consumes CPU and hangs the application. Attack requires network connectivity and no authentication. The fix is available in versions 0.4.9, 0.5.4, 0.6.11, 0.7.5, and 0.8.3 or later.
Affected products
- fflate fflate 0.4.5 through 0.8.2 (multiple affected ranges)
Timeline
- 2026-07-22: disclosed: CVE-2026-45820 published
- 2026-05-16: patched: fflate v0.8.3 released with fix