fflate CVE-2026-45820

No vendor-released patched version is confirmed at time of analysis - the source code reference points to a specific unpatched commit hash (f7873560), indicating that a fix had not been published to npm at the time of reporting. Organizations should monitor the fflate npm package for releases beyond 0.8.2 and upgrade as soon as a patched version is available. As an immediate compensating control, validate ZIP archives before passing them to unzipSync() by rejecting any central directory entry that sets compressed_size to 0xFFFFFFFF without a properly structured ZIP64 extra field block (tag 0x0001); this prevents z64e() from being invoked on malformed input. Wrapping unzipSync() in a try/catch block does NOT mitigate this vulnerability because no exception is thrown - the function simply never returns. For production services accepting ZIP uploads, run ZIP decompression in an isolated worker thread or child process with a watchdog timeout (for example, 30 seconds) so a hung parse can be killed without blocking the main event loop. Restricting ZIP upload endpoints to authenticated, trusted users reduces the attack surface at the network boundary with the trade-off of limiting public-facing functionality.