Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring compressed_size=0xFFFFFFFF (ZIP64 sentinel) but missing the required ZIP64 extra field tag 0x0001 causes z64e() to loop indefinitely due to out-of-bounds reads returning undefined, which coerces to 0, keeping the loop condition permanently true.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-07-22 | 1 | Disclosure1 |
| 2026-09-04 | 1 | Patch1 |
CVE Lite CLI opened a security fix PR on its own repo while I was sleeping. Found CVE-2026-45820 in fflate, validated the fix, opened the PR. Findings: 2 → 0. The tool patched itself. That's the goal. https://github.com/OWASP/cve-lite-cli/pull/1073
Post summary
CVE Lite CLI automatically discovered and patched CVE-2026-45820 in the fflate library, removing the vulnerability through its own security fix pull request.
CVE-2026-45820 Denial of Service via Infinite Loop in fflate through 0.8.2 unzipSync() https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-45820
Post summary
A DoS vulnerability has been disclosed in the fflate library (v0.8.2) due to an infinite loop in unzipSync(), potentially affecting users relying on that functionality.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | 101arrowz | fflate | - | node.js | - |