Fflate
Monthly
Denial of service in fflate through 0.8.2 exposes any application calling unzipSync() to an indefinite process hang when processing attacker-supplied ZIP archives. The synchronous decompression helper z64e() enters an infinite loop when a ZIP central directory entry sets compressed_size=0xFFFFFFFF (the ZIP64 sentinel) but omits the required extra field tag 0x0001, causing JavaScript out-of-bounds array reads to silently return undefined, which coerces to 0 and prevents the loop from ever terminating. No public exploit has been identified at time of analysis, but the attack is network-reachable with no authentication required (CVSS 4.0 PR:N, UI:N) and is flagged automatable (AU:Y), making it a credible denial-of-service threat against any fflate-consuming service that accepts untrusted ZIP input.
Denial of service in fflate through 0.8.2 exposes any application calling unzipSync() to an indefinite process hang when processing attacker-supplied ZIP archives. The synchronous decompression helper z64e() enters an infinite loop when a ZIP central directory entry sets compressed_size=0xFFFFFFFF (the ZIP64 sentinel) but omits the required extra field tag 0x0001, causing JavaScript out-of-bounds array reads to silently return undefined, which coerces to 0 and prevents the loop from ever terminating. No public exploit has been identified at time of analysis, but the attack is network-reachable with no authentication required (CVSS 4.0 PR:N, UI:N) and is flagged automatable (AU:Y), making it a credible denial-of-service threat against any fflate-consuming service that accepts untrusted ZIP input.