CLSA-2026-1789897715 TuxCare security update for fflate (1 CVE)

TuxCare rebuilt fflate to address 1 CVE. Fixed in 0.8.2-tuxcare.1...

Important: Red Hat Security Advisory: Kiali 2.22.10 for Red Hat OpenShift Service Mesh 3.3

Kiali 2.22.10 for Red Hat OpenShift Service Mesh 3.3 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

CVE-2026-45820

A flaw was found in fflate. A remote attacker could exploit this vulnerability by providing a specially crafted ZIP archive. This archive, when processed, can lead to an infinite loop during decompression, causing a Denial of Service DoS condition. This occurs because a malformed central director...

SUSE CVE-2026-45820

fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync. A crafted ZIP archive with a central directory entry declaring compressedsize=0xFFFFFFFF ZIP64 sentinel but missing the required ZIP64 extra field tag 0x0001 causes z64e to loop indefinitely due to...

@1delta/aggregators (>=0.1.0, <=0.1.6), @1delta/bridge-configs (>=0.1.0, <=0.1.9) +398 more potentially affected by CVE-2026-45820 via fflate (>=0.8.0, <=0.8.2)

fflate NPM version =0.8.0, =0.1.0, =0.1.0, =0.0.11, =0.0.52, =0.1.0, =0.0.72, =0.1.0, =1.5.3, =0.1.0, =0.13.6, =0.13.6, =0.13.6, =0.1.0, =0.1.1 and more Source cves: CVE-2026-45820 Source advisory: OSV:GHSA-PX8P-9VWX-VF98...

fflate unzipSync can enter an infinite loop when parsing malformed ZIP64 archives

fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync. A crafted ZIP archive with a central directory entry declaring compressedsize=0xFFFFFFFF ZIP64 sentinel but missing the required ZIP64 extra field tag 0x0001 causes z64e to loop indefinitely due to...

@bugreels/web-script (0.0.9), @dysonic/web-replay-chrome-extensions (>=0.1.0-beta.0, <=0.1.0) +6 more potentially affected by CVE-2026-45820 via fflate (0.4.8)

fflate NPM version 0.4.8 is affected by a known vulnerability. The following packages have a transitive dependency on fflate and may be impacted: - @bugreels/web-script 0.0.9 - @dysonic/web-replay-chrome-extensions =0.1.0-beta.0, =0.1.0-alpha.0, =0.1.0-alpha.0, =0.1.0-alpha.0, =0.1.0-alpha.0,...

@2gis/deck2gis-layer (>=3.0.0, <=3.0.13), @3cr/viewer-browser (>=0.0.327, <=0.0.333) +718 more potentially affected by CVE-2026-45820 via fflate (>=0.7.1, <=0.7.4)

fflate NPM version =0.7.1, =3.0.0, =0.0.327, =0.0.308, =1.0.29, =0.1.0, =3.0.17, =3.0.0-b.2, =1.3.1-isan.0, =1.3.3-isan.0, =0.1.0, =0.0.1, =0.1.1, =0.1.0, =1.0.1, =2.7.3 and more Source cves: CVE-2026-45820 Source advisory: OSV:GHSA-PX8P-9VWX-VF98...

GHSA-PX8P-9VWX-VF98 fflate unzipSync can enter an infinite loop when parsing malformed ZIP64 archives

fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync. A crafted ZIP archive with a central directory entry declaring compressedsize=0xFFFFFFFF ZIP64 sentinel but missing the required ZIP64 extra field tag 0x0001 causes z64e to loop indefinitely due to...

@polygonjs/plugin-mediapipe-facemesh (>=1.1.1, <=1.1.218), @polygonjs/polygonjs (>=1.1.124, <=1.1.239) +7 more potentially affected by CVE-2026-45820 via fflate (0.6.9)

fflate NPM version 0.6.9 is affected by a known vulnerability. The following packages have a transitive dependency on fflate and may be impacted: - @polygonjs/plugin-mediapipe-facemesh =1.1.1, =1.1.124, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.1, =0.5.0, =1.1.124-1, =1.1.239-1 Source cves:...

CVE-2026-45820

fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync. A crafted ZIP archive with a central directory entry declaring compressedsize=0xFFFFFFFF ZIP64 sentinel but missing the required ZIP64 extra field tag 0x0001 causes z64e to loop indefinitely due to...

CVE-2026-45820

fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync. A crafted ZIP archive with a central directory entry declaring compressedsize=0xFFFFFFFF ZIP64 sentinel but missing the required ZIP64 extra field tag 0x0001 causes z64e to loop indefinitely due to...

CVE-2026-45820

fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync. A crafted ZIP archive with a central directory entry declaring compressedsize=0xFFFFFFFF ZIP64 sentinel but missing the required ZIP64 extra field tag 0x0001 causes z64e to loop indefinitely due to...

CVE-2026-45820

fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync. A crafted ZIP archive with a central directory entry declaring compressedsize=0xFFFFFFFF ZIP64 sentinel but missing the required ZIP64 extra field tag 0x0001 causes z64e to loop indefinitely due to...

CVE-2026-45820

fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync. A crafted ZIP archive with a central directory entry declaring compressedsize=0xFFFFFFFF ZIP64 sentinel but missing the required ZIP64 extra field tag 0x0001 causes z64e to loop indefinitely due to...

CVE-2026-45820

fflate (versions up to 0.8.2) is vulnerable to denial of service through an infinite loop in unzipSync() when processing a crafted ZIP64 central directory entry: compressed_size=0xFFFFFFFF with missing ZIP64 extra tag 0x0001 causes out-of-bounds reads to yield 0, keeping the loop condition true. ...