CVE-2026-45820

fflate (versions up to 0.8.2) is vulnerable to denial of service through an infinite loop in unzipSync() when processing a crafted ZIP64 central directory entry: compressed_size=0xFFFFFFFF with missing ZIP64 extra tag 0x0001 causes out-of-bounds reads to yield 0, keeping the loop condition true. ...

CVE-2025-11569

All versions of the package cross-zip are vulnerable to Directory Traversal via consecutive usage of zipSync and unzipSync functions that allow arguments such as dirname. An attacker can access system files by selectively doing zip/unzip operations...

CVE-2025-11569

Rejected reason: This record was withdrawn by its CNA; further investigation revealed it was not a security issue...

CVE-2025-11569

...

PT-2025-41501

Name of the Vulnerable Software and Affected Versions cross-zip affected versions not specified Description The cross-zip JavaScript package, used for zipping and unzipping files in Node.js environments, is susceptible to a directory traversal issue. This arises from improper handling of...