CVE-2026-45820

fflate (versions up to 0.8.2) is vulnerable to denial of service through an infinite loop in unzipSync() when processing a crafted ZIP64 central directory entry: compressed_size=0xFFFFFFFF with missing ZIP64 extra tag 0x0001 causes out-of-bounds reads to yield 0, keeping the loop condition true. ...