Fflate
Monthly
Memory corruption in fflate up to and including 0.8.3 can be triggered when an application calls unzipSync in esm/index.mjs on a crafted ZIP archive, letting remote unauthenticated attackers induce a low-impact parsing or availability fault. Only applications that decompress attacker-controlled or attacker-influenced ZIP data with unzipSync are exposed; the assessed CVSS 3.1 impact is C:N/I:N/A:L rather than code execution. A public PoC reference exists but is not verified as working exploit code.
Denial of service in fflate through 0.8.2 exposes any application calling unzipSync() to an indefinite process hang when processing attacker-supplied ZIP archives. The synchronous decompression helper z64e() enters an infinite loop when a ZIP central directory entry sets compressed_size=0xFFFFFFFF (the ZIP64 sentinel) but omits the required extra field tag 0x0001, causing JavaScript out-of-bounds array reads to silently return undefined, which coerces to 0 and prevents the loop from ever terminating. No public exploit has been identified at time of analysis, but the attack is network-reachable with no authentication required (CVSS 4.0 PR:N, UI:N) and is flagged automatable (AU:Y), making it a credible denial-of-service threat against any fflate-consuming service that accepts untrusted ZIP input.
Memory corruption in fflate up to and including 0.8.3 can be triggered when an application calls unzipSync in esm/index.mjs on a crafted ZIP archive, letting remote unauthenticated attackers induce a low-impact parsing or availability fault. Only applications that decompress attacker-controlled or attacker-influenced ZIP data with unzipSync are exposed; the assessed CVSS 3.1 impact is C:N/I:N/A:L rather than code execution. A public PoC reference exists but is not verified as working exploit code.
Denial of service in fflate through 0.8.2 exposes any application calling unzipSync() to an indefinite process hang when processing attacker-supplied ZIP archives. The synchronous decompression helper z64e() enters an infinite loop when a ZIP central directory entry sets compressed_size=0xFFFFFFFF (the ZIP64 sentinel) but omits the required extra field tag 0x0001, causing JavaScript out-of-bounds array reads to silently return undefined, which coerces to 0 and prevents the loop from ever terminating. No public exploit has been identified at time of analysis, but the attack is network-reachable with no authentication required (CVSS 4.0 PR:N, UI:N) and is flagged automatable (AU:Y), making it a credible denial-of-service threat against any fflate-consuming service that accepts untrusted ZIP input.