{"id":"CVE-2026-122146","kind":"vulnerability","aliases":["CVE-2026-122146"],"related":[],"title":"fflate unzipSync allocates memory from the zip's declared size, so a small crafted zip can exhaust memory (no fix yet)","description":"A weakness has been identified in 101arrowz fflate up to 0.8.3. This issue affects the function unzipSync of the file esm/index.mjs. This manipulation causes memory corruption. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"Reporter's write-up (not the maintainer) describes this as unbounded allocation (CWE-789), not memory corruption: unzipSync in fflate 0.8.3 sizes each output buffer from the uncompressed size declared in the zip, with no upper bound. The reporter's PoC makes a 28,986-byte archive request 512 GiB of ArrayBuffer; on macOS it did not crash because pages are lazily committed, but the reporter expects failures in browsers and in Node under memory limits. The maintainer has not responded and no fix is released; 0.8.3 is the latest release. A related, separate bug (fflate issue #298, ZIP64 sentinel causing ~4 GiB allocation) has an open unmerged PR #301 that the reporter says would not fix the general case. This is a different CVE from CVE-2026-45820 (infinite loop, fixed in 0.8.3).","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"fflate","fixed":[],"affected":"<= 0.8.3","ecosystem":"npm"}],"ecosystems":[],"tags":["browser","denial-of-service","fflate","javascript","node","npm","package"],"not_affected_if":["fflate-newer-than-0.8.3","no-untrusted-zip-input","size-filter-in-place"],"how_to_check":"- Run `npm ls fflate` in each project; 0.8.3 and earlier are listed as affected, and 0.8.3 is the newest release.\n- Check whether any code path calls `unzipSync` (or async `unzip`, which the reporter says has the same pattern) on zip files from users or the network.\n- Workaround from the reporter (unverified by the maintainer): pass a filter, e.g. `unzipSync(bytes, { filter: f => f.originalSize < 4*1024*1024 })`; the filter runs before allocation. Also cap the number of entries and the upload size.","fix":null,"status":"open","published_at":"2026-11-05T01:17:22+00:00","first_seen_at":"2026-11-05T01:30:52+00:00","triaged_at":"2026-11-05T01:32:07+00:00","updated_at":"2026-11-05T01:34:05+00:00","category":"package","confidence":0.75,"triage":{"at":"2026-11-05T01:32:07Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"fflate: unzipSync memory corruption can be triggered remotely by attackers","impact":"high","summary":"fflate is a JavaScript compression library, and versions up to 0.8.3 have a flaw in its unzipSync function in esm/index.mjs that corrupts memory. The sources say a public exploit exists and the attack can be started remotely.","audience":"developers","category":"package","nicknames":[],"who_cares":["javascript","npm","fflate","node","browser"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"memory corruption that may let an attacker run code or crash the process","analyst_note":"Find the fixed fflate version and any vendor or maintainer advisory; the NVD entry alone gives no fix or exploit details.","how_to_check":"- Check the installed fflate version with `npm ls fflate` in each project that uses it\n- Look for `fflate` in `package.json` and lockfiles to find which apps import the ESM build\n- Note whether the app passes untrusted zip archives to `unzipSync`","plain_action":"","needs_analyst":true,"not_affected_if":["no-untrusted-zip-input","fflate-newer-than-0.8.3"],"who_is_affected":"Applications that use fflate 0.8.3 or earlier and call unzipSync on zip data, especially data that arrives from users or the network, are exposed. The sources do not state a fixed version. Projects that never decompress untrusted zip input are less likely to be reachable.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000709,"input_tokens":4236,"output_tokens":570,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed fflate version and any vendor or maintainer advisory; the NVD entry alone gives no fix or exploit details.","search":"'-122146':24A,27A '-2026':23A,26A,167B '-45820':168B '-789':53B '0.8.3':60B,126B,173B,184C '101arrowz':180C '28':83B '298':137B '301':149B '4':141B '512':88B '986':84B 'affect':187C 'alloc':3A,51B,143B 'archiv':86B 'arraybuff':91B 'attack':206C,222C 'avail':213C 'bound':76B 'browser':29B,109B 'buffer':64B 'bug':134B 'byte':85B 'case':159B 'caus':140B,197C 'commit':102B 'contact':226C 'corrupt':56B,199C 'could':218C 'craft':14A 'crash':97B 'cve':22A,25A,164B,166B 'cwe':52B 'declar':9A,69B 'denial':31B 'denial-of-servic':30B 'describ':47B 'differ':163B 'disclosur':230C 'earli':227C 'esm/index.mjs':194C 'exhaust':17A 'expect':106B 'exploit':209C 'failur':107B 'fflate':1A,28A,34B,59B,135B,181C 'file':193C 'fix':20A,123B,156B,171B 'function':189C 'general':158B 'gib':89B,142B 'identifi':178C 'infinit':169B 'initi':204C 'issu':136B,186C 'javascript':35B 'latest':129B 'lazili':101B 'limit':115B 'loop':170B 'maco':93B 'made':212C 'maintain':46B,117B 'make':81B 'manipul':196C 'memori':4A,18A,55B,114B,198C 'node':36B,112B 'npm':37B 'open':146B 'output':63B 'packag':38B 'page':99B 'poc':80B 'possibl':202C 'pr':148B 'public':216C 'relat':132B 'releas':125B,130B 'remot':207C 'report':39B,78B,105B,152B 'request':87B 'respond':120B,234C 'say':153B 'sentinel':139B 'separ':133B 'servic':33B 'size':10A,61B,68B 'small':13A 'unbound':50B 'uncompress':67B 'unmerg':147B 'unzipsync':2A,57B,190C 'upper':75B 'use':220C 'vendor':224C 'way':237C 'weak':175C 'would':154B 'write':42B 'write-up':41B 'yet':21A 'zip':7A,15A,72B 'zip64':138B","nicknames":[],"mitigations":[],"who_affected":"Apps using fflate 0.8.3 or earlier that call unzipSync (the reporter says the async unzip has the same pattern) on zip files from untrusted sources, in Node servers or in browsers. A small crafted archive can make the library request very large buffers, which can crash a tab or a memory-limited process. Apps that only unzip trusted files, or already filter by declared size, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"pkeys":["fflate"],"ptokens":["fflate"],"labels":["browser","denialofservice","fflate","high","javascript","node","npm","package"],"campaign_type":null,"first_public_at":"2026-11-05T01:17:22+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-122146","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122146","severity":null,"published_at":"2026-11-05T01:17:22+00:00","modified_at":"2026-11-05T01:17:22+00:00","first_seen_at":"2026-11-05T01:30:52+00:00","fetched_at":"2026-11-05T01:30:52+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-122146:1742","url":"https://github.com/ictrun/java/issues/9","severity":null,"published_at":"2026-11-05T01:34:05+00:00","modified_at":"2026-11-05T01:34:05+00:00","first_seen_at":"2026-11-05T01:34:05+00:00","fetched_at":"2026-11-05T01:34:05+00:00","note":"Primary maintainer advisory does not exist; fflate has no SECURITY.md. Details from reporter's issue ictrun/java#9 (PoC script inline, public). Real bug is unbounded allocation, not memory corruption as NVD says; title rewritten. No fix: latest release 0.8.3, PR #301 open and only covers the ZIP64 sentinel case. Nothing marked verified (no vendor words). X not searched. CVE-2026-45820 is a different fflate bug.","cites":["https://github.com/ictrun/java/issues/9","https://github.com/101arrowz/fflate/issues/298","https://github.com/101arrowz/fflate/pull/301","https://github.com/101arrowz/fflate/releases/tag/v0.8.3"]}],"documents":[{"id":72019,"url":"https://github.com/ictrun/java/issues/9","title":"[CVE-2026-122146] fflate unzipSync Memory Exhaustion via Unbounded Allocation (reporter's write-up)","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":72020,"url":"https://github.com/101arrowz/fflate/issues/298","title":"fflate #298: unzipSync treats ZIP64 size sentinels as actual sizes (~4 GiB allocation)","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":72021,"url":"https://github.com/101arrowz/fflate/pull/301","title":"fflate PR #301 (open, unmerged): Fix ZIP64 entry fields without a ZIP64 end record","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":72022,"url":"https://github.com/101arrowz/fflate/releases/tag/v0.8.3","title":"fflate v0.8.3 release (latest)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"exploit_sources":[{"type":"poc","url":"https://github.com/ictrun/java/issues/9"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}