GHSA-px8p-9vwx-vf98

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
6.6 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/S:N/AU:Y/R:U/V:D/RE:M/U:Amber CVSS Calculator

Summary

fflate unzipSync can enter an infinite loop when parsing malformed ZIP64 archives

Details

fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring compressed_size=0xFFFFFFFF (ZIP64 sentinel) but missing the required ZIP64 extra field tag 0x0001 causes z64e() to loop indefinitely due to out-of-bounds reads returning undefined, which coerces to 0, keeping the loop condition permanently true.

Database specific

{
    "cwe_ids": [
        "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-03T14:58:12Z",
    "nvd_published_at": "2026-07-22T08:16:23Z",
    "severity": "MODERATE"
}

References

Affected packages

npm / fflate

Package

Name: fflate; View open source insights on deps.dev
Purl: pkg:npm/fflate

Affected ranges

Type: SEMVER
Events: Introduced

0.4.5

Fixed

0.4.9

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-px8p-9vwx-vf98/GHSA-px8p-9vwx-vf98.json"

npm / fflate

Package

Name: fflate; View open source insights on deps.dev
Purl: pkg:npm/fflate

Affected ranges

Type: SEMVER
Events: Introduced

0.5.0

Fixed

0.5.4

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-px8p-9vwx-vf98/GHSA-px8p-9vwx-vf98.json"

npm / fflate

Package

Name: fflate; View open source insights on deps.dev
Purl: pkg:npm/fflate

Affected ranges

Type: SEMVER
Events: Introduced

0.6.0

Fixed

0.6.11

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-px8p-9vwx-vf98/GHSA-px8p-9vwx-vf98.json"

npm / fflate

Package

Name: fflate; View open source insights on deps.dev
Purl: pkg:npm/fflate

Affected ranges

Type: SEMVER
Events: Introduced

0.7.0

Fixed

0.7.5

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-px8p-9vwx-vf98/GHSA-px8p-9vwx-vf98.json"

npm / fflate

Package

Name: fflate; View open source insights on deps.dev
Purl: pkg:npm/fflate

Affected ranges

Type: SEMVER
Events: Introduced

0.8.0

Fixed

0.8.3

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-px8p-9vwx-vf98/GHSA-px8p-9vwx-vf98.json"