7.5

CVE-2026-45820: 101arrowz fflate Uncontrolled Resource Consumption

Analyzed
AliasesCGA-249r-hx9c-w7fvCGA-5pvv-pfmq-xj45CGA-637j-qhr2-rx59
Published 22-07-2026Last modified 22-07-2026

Vulnerability summary

CVE-2026-45820 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in 101arrowz fflate. EPSS estimates a 0.28% chance of exploitation in the next 30 days, higher than 20.4% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 6.6, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
7.5/10
010
High · v3.1 (NVD)
EPSS score
0.28%
0%100%
Low · -0.21 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 1
CGA-RRV4-WHQW-RJ5V

Timeline

  1. 22-07-2026
    PublishedVulnerability first disclosed.
  2. 22-07-2026
    Last modifiedVulnerability information updated.

Description

fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring compressed_size=0xFFFFFFFF (ZIP64 sentinel) but missing the required ZIP64 extra field tag 0x0001 causes z64e() to loop indefinitely due to out-of-bounds reads returning undefined, which coerces to 0, keeping the loop condition permanently true.

CVSS metrics

7 scores · 5 sources · 2 versions

EPSS trend

Probability

0.28%

Chance of exploitation in the next 30 days

Percentile

20%

Versus all other CVEs

30-day change

Decrease -0.21 pp

From 0.49% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard16 products
  • commercial-gitlab-rails-ee-19.1< 19.1.7-r3
  • commercial-gitlab-rails-ee-19.2< 19.2.7-r1
  • commercial-gitlab-rails-ee-19.3< 19.3.3-r1
  • commercial-gitlab-rails-ee-fips-19.1All versions (No fix recorded) | < 19.1.9-r0
  • commercial-gitlab-rails-ee-fips-19.2< 19.2.7-r1
Wolfi3 products
  • langfuse-3-compat< 3.225.7-r6
  • langfuse-3-worker< 3.225.7-r2
  • tileserver-gl< 5.6.0-r15
101arrowz1 product
  • fflate≥ 0.4.5, ≤ 0.4.8 | ≥ 0.5.0, ≤ 0.5.3 | ≥ 0.6.0, ≤ 0.6.10 | ≥ 0.7.0, ≤ 0.7.4 | ≥ 0.8.0, ≤ 0.8.2 | ≤ 0.8.2
Npm1 product
  • fflate≥ 0.4.5, < 0.4.9 | ≥ 0.5.0, < 0.5.4 | ≥ 0.6.0, < 0.6.11 | ≥ 0.7.0, < 0.7.5 | ≥ 0.8.0, < 0.8.3

4 vendors · 21 products

References

7 links