CVE-2026-45820

A flaw was found in fflate. A remote attacker could exploit this vulnerability by providing a specially crafted ZIP archive. This archive, when processed, can lead to an infinite loop during decompression, causing a Denial of Service (DoS) condition. This occurs because a malformed central directory entry in the ZIP archive causes out-of-bounds reads, which keeps a processing loop permanently active.

This CVE describes a denial-of-service flaw in the fflate JavaScript compression library. Parsing a maliciously crafted ZIP archive via unzipSync()/unzip() triggers an infinite loop in the ZIP64 central-directory parser (z64e): a central directory entry declaring the ZIP64 size sentinel (0xFFFFFFFF) but omitting the required ZIP64 extra field causes out-of-bounds reads that keep the loop condition permanently true, consuming CPU indefinitely. Only fflate's ZIP-extraction APIs are affected; its gzip/deflate/zip-creation paths are not.

Red Hat products bundle fflate almost exclusively within web-frontend assets. Each affected component was assessed individually. Components that reach fflate only through compression-only consumers (posthog-js gzip telemetry, jsPDF zlib) never invoke the vulnerable unzipSync/z64e path and are marked not affected (vulnerable code not in the execute path). Components that bundle fflate in the vulnerable version range (through 0.8.2) where the ZIP-extraction path could not be positively excluded are marked affected. Where the vulnerable path is reachable only from client-side browser code processing same-origin assets, practical impact is limited to a self-inflicted denial of service within the user's own browser session rather than a service-level outage.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

There is no available mitigation for this flaw other than updating the bundled fflate library to a fixed version (0.8.3 or later). Where the application controls the input, avoid passing untrusted ZIP archives to fflate's unzip()/unzipSync() APIs.