Skip to content
Fencer Vulns
high 7.5

CVE-2026-45820 json

fflate unzipSync can enter an infinite loop when parsing malformed ZIP64 archives

published 2026-07-22 3 mo ago modified 2026-10-24 15 d ago also GHSA-px8p-9vwx-vf98 , EUVD-2026-47616

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 20%
public exploits
0
none known

Summary

fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring compressed_size=0xFFFFFFFF (ZIP64 sentinel) but missing the required ZIP64 extra field tag 0x0001 causes z64e() to loop indefinitely due to out-of-bounds reads returning undefined, which coerces to 0, keeping the loop condition permanently true.

Patch / fix

  • npm fflate 0.4.9, 0.5.4, 0.6.11, 0.7.5, 0.8.3

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-45820 updated cvss 7.5

fflate: fflate: Denial of Service via crafted ZIP archives

  • Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-console-plugin-rhel9, openshift-lightspeed/lightspeed-console-plugin-419-rhel9
    affected: workaround, no fix available
  • Red Hat Advanced Cluster Security 4 advanced-cluster-security/rhacs-main-rhel8
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Ceph Storage 9 ceph, cephadm, librbd1, librgw2, rbd-nbd, ceph-mib, +17 more
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/gateway-rhel9 1791971533
    fixed: vendor fix RHSA-2026:87120
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-platform-ui 2.6.15-1.el9ap
    fixed: vendor fix RHSA-2026:87004
  • Red Hat Ansible Automation Platform 2.7 ansible-automation-platform-27/gateway-rhel9 1791257377
    fixed: vendor fix RHSA-2026:79378
  • Red Hat OpenShift AI 2.25 rhoai/odh-dashboard-rhel9 1791853525, rhoai/odh-mod-arch-model-registry-rhel9 1791853432
    fixed: vendor fix RHSA-2026:87410
  • Red Hat OpenShift AI 3.4 rhoai/odh-dashboard-rhel9 1793001801, rhoai/odh-mod-arch-maas-rhel9 1791860708, rhoai/odh-mod-arch-automl-rhel9 1791861032, rhoai/odh-mod-arch-gen-ai-rhel9 1793001896, rhoai/odh-mod-arch-mlflow-rhel9 1791861383, rhoai/odh-mod-arch-mlflow-rhel9 1793001851, +3 more
    fixed: vendor fix RHSA-2026:92510
show 7 more
  • Red Hat OpenShift Service Mesh 3.3 openshift-service-mesh/kiali-rhel9 1789027395, openshift-service-mesh/kiali-ossmc-rhel9 1789050085
    fixed: vendor fix RHSA-2026:68690
  • Red Hat OpenShift Service Mesh 3.4 openshift-service-mesh/kiali-rhel9 1789021319, openshift-service-mesh/kiali-ossmc-rhel9 1789475294
    fixed: vendor fix RHSA-2026:68695
  • Red Hat Ansible Automation Platform 2 automation-gateway Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/hub-rhel9 1791947385, ansible-automation-platform-26/hub-web-rhel9 1791952205, ansible-automation-platform-26/receptor-rhel9 1791968536, ansible-automation-platform-26/mcp-tools-rhel9 1791941340, ansible-automation-platform-26/controller-rhel9 1791947602, ansible-automation-platform-26/de-minimal-rhel9 1791961810, +24 more Red Hat Ansible Automation Platform 2.6 for RHEL 9 receptor 1.6.9-1.el9ap, molecule 26.10.0-1.el9ap, receptorctl 1.6.9-1.el9ap, ansible-lint 26.10.1-1.el9ap, ansible-rulebook 1.2.3-1.el9ap, automation-hub 4.11.15-1.el9ap, +51 more Red Hat Ansible Automation Platform 2.6 for RHEL 10 receptor 1.6.9-1.el10ap, molecule 26.10.0-1.el10ap, python-cffi 2.0.0-2.el10ap, receptorctl 1.6.9-1.el10ap, python3-cffi 2.0.0-2.el10ap, ansible-lint 26.10.1-1.el10ap, +11 more Red Hat Ansible Automation Platform 2.7 ansible-automation-platform-27/hub-rhel9 1791254555, ansible-automation-platform-27/hub-web-rhel9 1791264503, ansible-automation-platform-27/receptor-rhel9 1791251288, ansible-automation-platform-27/mcp-tools-rhel9 1790931895, ansible-automation-platform-27/controller-rhel9 1791253059, ansible-automation-platform-27/de-minimal-rhel9 1790931681, +26 more
    not affected: vulnerable code not present
  • Red Hat Developer Hub 1 rhdh/rhdh-hub-rhel9, rhdh/red-hat-developer-hub-backstage-plugin-lightspeed
    not affected: vulnerable code not in execute path
  • Red Hat Enterprise Linux 8 grafana, grafana-loki, grafana-mssql, grafana-mysql, grafana-selinux, grafana-graphite, +8 more Red Hat Enterprise Linux 9 grafana, grafana-selinux
    not affected: vulnerable code not present
  • Red Hat Hardened Images grafana12.4, grafana13.1, grafana13.2, ruff 0.15.11-1.hum1
    not affected: component not present
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-mod-arch-agent-ops-rhel9 Red Hat OpenShift AI 2.25 rhoai/odh-rhel9-operator 1792570619, rhoai/odh-vllm-cpu-rhel9 1792018436, rhoai/odh-modelmesh-rhel9 1790881700, rhoai/odh-operator-bundle 1792571069, rhoai/odh-vllm-cuda-rhel9 1791358976, rhoai/odh-vllm-rocm-rhel9 1791282503, +64 more Red Hat OpenShift AI 3.4 rhoai/odh-cli-rhel9 1791509689, rhoai/odh-cli-rhel9 1792722177, rhoai/rhai-cli-rhel9 1791509689, rhoai/rhai-cli-rhel9 1792722177, rhoai/odh-automl-rhel9 1791535789, rhoai/odh-automl-rhel9 1792697253, +197 more Red Hat OpenShift Container Platform 4 openshift4/ose-agent-installer-ui-rhel9 Red Hat OpenShift Container Platform 5 openshift5/ose-agent-installer-ui-rhel9 Red Hat OpenShift Service Mesh 3.4 openshift-service-mesh/kiali-rhel9-operator 1789021200, openshift-service-mesh/kiali-operator-bundle 1789478366
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
3 mo ago

Exploit prediction

0.28% chance of exploitation in the next 30 days, higher than 20% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 6.6 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/S:N/AU:Y/R:U/V:D/RE:M/U:Amber
CNA 4.0 6.6 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
npm fflate
>=0.4.5, <0.4.9
>=0.5.0, <0.5.4
>=0.6.0, <0.6.11
>=0.7.0, <0.7.5
>=0.8.0, <0.8.3
0.4.9
0.5.4
0.6.11
0.7.5
0.8.3

Affected products

  • 101arrowz fflate

Classification

Weakness
  • CWE-835 Loop with Unreachable Exit Condition
  • CWE-400 Uncontrolled Resource Consumption

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.