CVE-2026-45820: fflate Denial of Service Vulnerability

CVE-2026-45820 Overview

CVE-2026-45820 is a denial of service vulnerability affecting the fflate JavaScript compression library through version 0.8.2. The flaw resides in the unzipSync() function, which enters an infinite loop when parsing a crafted ZIP archive. An attacker supplies a central directory entry declaring compressed_size=0xFFFFFFFF (the ZIP64 sentinel) while omitting the required ZIP64 extra field tag 0x0001. This causes the z64e() helper to perform out-of-bounds reads that return undefined, which JavaScript coerces to 0, keeping the loop condition permanently true. The issue is tracked under [CWE-400: Uncontrolled Resource Consumption].

Critical Impact
Any Node.js or browser application that calls unzipSync() on untrusted ZIP input will hang indefinitely, exhausting the event loop and blocking service availability.

Affected Products

fflate JavaScript library versions through 0.8.2
Node.js applications that decompress user-supplied ZIP archives using fflate
Browser or serverless workloads bundling fflate for client-side ZIP parsing

Discovery Timeline

2026-07-22 - CVE-2026-45820 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-45820

Vulnerability Analysis

The fflate library implements ZIP64 support to handle archives larger than 4 GiB. When a central directory entry advertises a compressed size of 0xFFFFFFFF, the parser must locate the ZIP64 extended information extra field (tag 0x0001) to obtain the true 64-bit size. unzipSync() delegates this lookup to the internal z64e() function.

The function scans the extra field region for the ZIP64 tag but does not validate that the tag is present before dereferencing offsets. When the tag is missing, index accesses fall past the end of the typed array and yield undefined. JavaScript's implicit numeric coercion converts undefined to 0, and the loop counter never advances toward its terminating condition. Execution remains trapped inside the parser.

Root Cause

The root cause is missing bounds and presence validation in z64e(). The function assumes the ZIP64 sentinel and the corresponding extra field always occur together, an invariant the ZIP specification does not enforce for attacker-supplied input. Combined with JavaScript's silent coercion of undefined to numeric zero, a malformed archive turns a bounded parse into an infinite loop.

Attack Vector

An unauthenticated remote attacker delivers a crafted ZIP archive to any endpoint that invokes unzipSync(). Typical exposure points include file upload handlers, email attachment scanners, package extraction services, and client-side archive viewers. Processing the archive consumes 100% of one CPU core and blocks the Node.js single-threaded event loop, denying service to all concurrent requests handled by that process.

The vulnerability requires no authentication, no user interaction, and no special network position. See the fflate source code for the affected z64e() implementation.

Detection Methods for CVE-2026-45820

Indicators of Compromise

Node.js processes exhibiting sustained 100% single-core CPU utilization after receiving a ZIP upload
Application request queues stalling with no error output and no crash signal
Inbound ZIP archives containing central directory records with compressed_size=0xFFFFFFFF but no 0x0001 extra field tag

Detection Strategies

Inventory Node.js and browser projects for a dependency on fflate at versions <= 0.8.2 using npm ls fflate or Software Composition Analysis tooling
Add runtime timeouts around unzipSync() invocations and alert when parsing exceeds an expected wall-clock threshold
Inspect uploaded archives with a validating ZIP parser and flag entries where the ZIP64 sentinel appears without a matching extra field

Monitoring Recommendations

Track per-process CPU and event-loop lag metrics for services that accept archive uploads
Log the SHA-256 hash and size of every ZIP archive submitted to decompression endpoints for post-incident review
Correlate spikes in HTTP request latency with recent archive uploads through your SIEM

How to Mitigate CVE-2026-45820

Immediate Actions Required

Upgrade fflate to a fixed release once published by the maintainer, and rebuild all downstream bundles
Wrap unzipSync() calls in a worker thread or child process with a hard execution timeout to contain hangs
Reject uploaded ZIP archives that exceed a documented size or entry-count budget before invoking the parser

Patch Information

At publication no fixed version is listed on the NVD entry. Consult the fflate npm package page for the latest release and changelog, and pin the patched version in package.json once available.

Workarounds

Replace unzipSync() with the asynchronous unzip() API and enforce a timeout to abort runaway parses
Pre-validate archives with a hardened ZIP parser that rejects mismatched ZIP64 sentinels and extra field tags
Isolate archive decompression in a sandboxed worker with strict CPU and memory limits

bash

# Configuration example: enforce a parse timeout in a Node.js worker
# Run unzipSync inside a Worker and terminate after 5 seconds
node --experimental-worker unzip-worker.js --timeout=5000