CyberRota Analysis
AI-GeneratedThe vulnerability affects the fflate library versions up to 0.8.2, which can be exploited through a specially crafted ZIP archive that triggers an infinite loop in the unzipSync() function. This denial-of-service condition results from improper handling of ZIP64 entries, leading to resource exhaustion. Developers and organizations using the fflate library should prioritize addressing this issue to prevent potential service disruptions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring compressed_size=0xFFFFFFFF (ZIP64 sentinel) but missing the required ZIP64 extra field tag 0x0001 causes z64e() to loop indefinitely due to out-of-bounds reads returning undefined, which coerces to 0, keeping the loop condition permanently true.