Description
fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync().
Recommendation
Update the fflate package to the latest compatible version. Followings are version details:
Affected version(s): **>= 0.8.0, < 0.8.3 >= 0.7.0, < 0.7.5 >= 0.6.0, < 0.6.11 >= 0.5.0, < 0.5.4 >= 0.4.5, < 0.4.9** Patched version(s): **0.8.3 0.7.5 0.6.11 0.5.4 0.4.9**
References
Could your website be exposed too?
SmartScanner can check your website for fflate unzipSync can enter an infinite loop when parsing malformed ZIP64 archives and gives you actionable findings to investigate.
Start a free scanRelated Issues
- nanoid: custom generators can loop indefinitely when size is zero - CVE-2026-67213
- jsrsasign is vulnerable to DoS through Infinite Loop when processing zero or negative inputs - CVE-2026-4598
- protobufjs: Denial of Service via infinite loop in .proto option parsing - CVE-2026-59877
- nanoid: non-secure generators can loop indefinitely with negative size - CVE-2026-67214
You might also like:
See something that needs correcting? Let us knowUpdated September 03, 2026