---
id: "CVE-2026-122146"
kind: "vulnerability"
aliases: ["CVE-2026-122146"]
title: "fflate unzipSync allocates memory from the zip's declared size, so a small crafted zip can exhaust memory (no fix yet)"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "fflate", "fixed": [], "affected": "<= 0.8.3", "ecosystem": "npm"}]
ecosystems: []
tags: ["browser", "denial-of-service", "fflate", "javascript", "node", "npm", "package"]
not_affected_if: ["fflate-newer-than-0.8.3", "no-untrusted-zip-input", "size-filter-in-place"]
published_at: "2026-11-05T01:17:22+00:00"
first_seen_at: "2026-11-05T01:30:52+00:00"
updated_at: "2026-11-05T01:34:05+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-122146", "first_seen_at": "2026-11-05T01:30:52+00:00"}, {"source": "analyst", "url": "https://github.com/101arrowz/fflate/issues/298", "first_seen_at": "2026-11-05T01:34:05+00:00", "cites": ["https://github.com/101arrowz/fflate/issues/298", "https://github.com/101arrowz/fflate/pull/301", "https://github.com/101arrowz/fflate/releases/tag/v0.8.3", "https://github.com/ictrun/java/issues/9"]}]
exploit_sources: [{"type": "poc", "url": "https://github.com/ictrun/java/issues/9"}]
---

# fflate unzipSync allocates memory from the zip's declared size, so a small crafted zip can exhaust memory (no fix yet)

Reporter's write-up (not the maintainer) describes this as unbounded allocation (CWE-789), not memory corruption: unzipSync in fflate 0.8.3 sizes each output buffer from the uncompressed size declared in the zip, with no upper bound. The reporter's PoC makes a 28,986-byte archive request 512 GiB of ArrayBuffer; on macOS it did not crash because pages are lazily committed, but the reporter expects failures in browsers and in Node under memory limits. The maintainer has not responded and no fix is released; 0.8.3 is the latest release. A related, separate bug (fflate issue #298, ZIP64 sentinel causing ~4 GiB allocation) has an open unmerged PR #301 that the reporter says would not fix the general case. This is a different CVE from CVE-2026-45820 (infinite loop, fixed in 0.8.3).

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:fflate affected <= 0.8.3 fixed no fixed version listed

## How to check

- Run `npm ls fflate` in each project; 0.8.3 and earlier are listed as affected, and 0.8.3 is the newest release.
- Check whether any code path calls `unzipSync` (or async `unzip`, which the reporter says has the same pattern) on zip files from users or the network.
- Workaround from the reporter (unverified by the maintainer): pass a filter, e.g. `unzipSync(bytes, { filter: f => f.originalSize < 4*1024*1024 })`; the filter runs before allocation. Also cap the number of entries and the upload size.

## Timeline

- 2026-11-05T01:30:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-122146
- 2026-11-05T01:34:05+00:00 analyst https://github.com/101arrowz/fflate/issues/298 — Primary maintainer advisory does not exist; fflate has no SECURITY.md. Details from reporter's issue ictrun/java#9 (PoC script inline, public). Real bug is unbounded allocation, not memory corruption as NVD says; title rewritten. No fix: latest release 0.8.3, PR #301 open and only covers the ZIP64 sentinel case. Nothing marked verified (no vendor words). X not searched. CVE-2026-45820 is a different fflate bug.

## Documents

- [describes] fflate #298: unzipSync treats ZIP64 size sentinels as actual sizes (~4 GiB allocation) https://github.com/101arrowz/fflate/issues/298
- [mentions] fflate PR #301 (open, unmerged): Fix ZIP64 entry fields without a ZIP64 end record https://github.com/101arrowz/fflate/pull/301
- [mentions] fflate v0.8.3 release (latest) https://github.com/101arrowz/fflate/releases/tag/v0.8.3
- [poc] [CVE-2026-122146] fflate unzipSync Memory Exhaustion via Unbounded Allocation (reporter's write-up) https://github.com/ictrun/java/issues/9

## From the sources

A weakness has been identified in 101arrowz fflate up to 0.8.3. This issue affects the function unzipSync of the file esm/index.mjs. This manipulation causes memory corruption. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_