fflate EUVD-2026-47616

Exploitation requires that the target application (1) accepts ZIP archive input from an untrusted or remote source, and (2) passes that input to fflate's unzipSync() function. The vulnerability is specific to the synchronous unzipSync() code path via the z64e() helper - the async unzip() API follows a different execution path, though whether it shares the same vulnerable helper is not independently confirmed from available data and should not be assumed safe without code review. No authentication, no special server configuration, and no specific operating system are required; the flaw is in pure JavaScript/TypeScript logic and affects any runtime environment (Node.js, browser, Deno, Bun) running fflate ≤0.8.2. The CVSS 4.0 PR:N and UI:N confirm no privilege or user interaction is needed from the attacker's perspective. Exploitation is limited to applications that process attacker-controlled ZIP archives; services that only decompress internally generated or pre-validated ZIPs are not exploitable.

The CVSS 4.0 score of 6.6 (Medium) with base vector AV:N/AC:L/AT:N/PR:N/UI:N reflects a network-reachable, zero-authentication attack path with high availability impact and no confidentiality or integrity exposure - an accurate characterization of a pure DoS. The supplemental metric AU:Y (automatable) is especially significant: a threat actor can craft the malformed archive deterministically and submit it at scale with no human-in-the-loop requirement, enabling mass targeting of exposed endpoints. The E:U (unexploited) signal and absence from CISA KEV indicate no confirmed active exploitation at time of scoring, which moderates urgency. EPSS data was not provided in the available intelligence, limiting probabilistic exploitation forecasting. The combination of trivial trigger (a single malformed file), zero-authentication requirement, and automation potential elevates the practical risk above what the Medium CVSS score alone suggests - particularly for publicly exposed file-processing services. There is no conflict between the CVSS vector and the description; both confirm the network-local exploitation model. The score is appropriately bounded by the DoS-only impact scope.

An attacker crafts a ZIP archive whose central directory sets compressed_size to 0xFFFFFFFF but intentionally omits the ZIP64 extra field, then submits the file to any web service, API endpoint, or build tool that calls fflate's unzipSync() on untrusted input - such as a file conversion API, archive preview feature, or CI artifact processor. The target process enters an infinite loop consuming 100% of a CPU core and never returns, causing the request to hang and ultimately starving the application of worker threads or connection slots, resulting in complete service unavailability. Because the trigger is a valid-looking ZIP structure, standard file-type validation and extension filtering provide no protection.