Read the docs
TI-2026-33552 Aliases CVE-2026-45820GHSA-px8p-9vwx-vf98

Uncontrolled resource consumption in 101arrowz fflate

Priority LOW 35CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 7 fixed, 3 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring compressed_size=0xFFFFFFFF (ZIP64 sentinel) but missing the required ZIP64 extra field tag 0x0001 causes z64e() to loop indefinitely due to out-of-bounds reads returning undefined, which coerces to 0, keeping the loop condition permanently true.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00279 20th percentileScored 2026-11-07
Fix Partial fflate (npm): 0.4.9, 0.5.4, 0.6.11 +2Red Hat: 8 advisoriesRed Hat: 7 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
101arrowzfflate0.4.5 – 0.4.8; 0.5.0 – 0.5.3; 0.6.0 – 0.6.10; 0.7.0 – 0.7.4; 0.8.0 – 0.8.2—No fix listedCNA
—fflate (npm)0.4.5 to before 0.4.90.4.9Patch availableGHSA-px8p-9vwx-vf98
—fflate (npm)0.5.0 to before 0.5.40.5.4Patch availableGHSA-px8p-9vwx-vf98
—fflate (npm)0.6.0 to before 0.6.110.6.11Patch availableGHSA-px8p-9vwx-vf98
—fflate (npm)0.7.0 to before 0.7.50.7.5Patch availableGHSA-px8p-9vwx-vf98
—fflate (npm)0.8.0 to before 0.8.30.8.3Patch availableGHSA-px8p-9vwx-vf98
  • fflate Vendor101arrowz Affected 0.4.5 – 0.4.8; 0.5.0 – 0.5.3; 0.6.0 – 0.6.10; 0.7.0 – 0.7.4; 0.8.0 – 0.8.2 Fixed in — No fix listed CNA
  • fflate (npm) Vendor— Affected 0.4.5 to before 0.4.9 Fixed in 0.4.9 Patch available GHSA-px8p-9vwx-vf98
  • fflate (npm) Vendor— Affected 0.5.0 to before 0.5.4 Fixed in 0.5.4 Patch available GHSA-px8p-9vwx-vf98
  • fflate (npm) Vendor— Affected 0.6.0 to before 0.6.11 Fixed in 0.6.11 Patch available GHSA-px8p-9vwx-vf98
  • fflate (npm) Vendor— Affected 0.7.0 to before 0.7.5 Fixed in 0.7.5 Patch available GHSA-px8p-9vwx-vf98
  • fflate (npm) Vendor— Affected 0.8.0 to before 0.8.3 Fixed in 0.8.3 Patch available GHSA-px8p-9vwx-vf98

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:101arrowz:fflate:*:*:*:*:*:node.js:*:*up to 0.8.2Vulnerable101arrowz
  • cpe:2.3:a:101arrowz:fflate:*:*:*:*:*:node.js:*:* Versions up to 0.8.2 Vulnerable ·101arrowz

Remediation

  • Fix · GHSA-px8p-9vwx-vf98 fflate (npm) Fixed in 0.4.9 Advisory →
  • Fix · GHSA-px8p-9vwx-vf98 fflate (npm) Fixed in 0.5.4 Advisory →
  • Fix · GHSA-px8p-9vwx-vf98 fflate (npm) Fixed in 0.6.11 Advisory →
  • Fix · GHSA-px8p-9vwx-vf98 fflate (npm) Fixed in 0.7.5 Advisory →
  • Fix · GHSA-px8p-9vwx-vf98 fflate (npm) Fixed in 0.8.3 Advisory →

Red Hat 8 advisories

  • RHSA-2026:92510 Released 2026-10-29 · Red Hat rating Critical
    RHOAI 3.4.6 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-cli-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
  • RHSA-2026:87410 Released 2026-10-21 · Red Hat rating Critical
    RHOAI 2.25.12 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-codeflare-operator-rhel9 +47
  • RHSA-2026:87120 Released 2026-10-21 · Red Hat rating Critical
    Red Hat Ansible Automation Platform 2.6 Container Release Update
    • Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/eda-controller-rhel9, registry.redhat.io/ansible-automation-platform-26/ee-supported-rhel9, registry.redhat.io/ansible-automation-platform-26/gateway-rhel9 +8
Show 5 more Red Hat advisories
  • RHSA-2026:87004 Released 2026-10-21 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-gateway-server-2.6.20261019-1.el9ap, automation-platform-ui-2.6.15-1.el9ap, python3.12-pulpcore-3.49.71-1.el9ap +2
  • RHSA-2026:84734 Released 2026-10-19 · Red Hat rating Critical
    RHOAI 3.4.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
  • RHSA-2026:79378 Released 2026-10-08 · Red Hat rating Critical
    Red Hat Ansible Automation Platform 2.7 Container Release Update
    • Red Hat Ansible Automation Platform 2.7 registry.redhat.io/ansible-automation-platform-27/controller-rhel9, registry.redhat.io/ansible-automation-platform-27/ee-supported-rhel9, registry.redhat.io/ansible-automation-platform-27/gateway-rhel9 +4
  • RHSA-2026:68695 Released 2026-09-17 · Red Hat rating Important
    Kiali 2.27.4 for Red Hat OpenShift Service Mesh 3.4
    • Red Hat OpenShift Service Mesh 3.4 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator
  • RHSA-2026:68690 Released 2026-09-17 · Red Hat rating Important
    Kiali 2.22.10 for Red Hat OpenShift Service Mesh 3.3
    • Red Hat OpenShift Service Mesh 3.3 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift LightspeedAffectedNo fix yet
Red Hat Advanced Cluster Security 4AffectedNo fix planned: Will not fix
Red Hat Ceph Storage 9AffectedNo fix planned: Out of support scope
Red Hat Ansible Automation Platform 2.6Fixed RHSA-2026:87120
Red Hat Ansible Automation Platform 2.6 for RHEL 9Fixed RHSA-2026:87004
Red Hat Ansible Automation Platform 2.7Fixed RHSA-2026:79378
Red Hat OpenShift AI 2.25Fixed RHSA-2026:87410
Red Hat OpenShift AI 3.4Fixed RHSA-2026:84734, RHSA-2026:92510
Red Hat OpenShift Service Mesh 3.3Fixed RHSA-2026:68690
Red Hat OpenShift Service Mesh 3.4Fixed RHSA-2026:68695
Not affected: 15 products
  • Red Hat Ansible Automation Platform 2
  • Red Hat Ansible Automation Platform 2.6
  • Red Hat Ansible Automation Platform 2.6 for RHEL 10
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • Red Hat Ansible Automation Platform 2.7
  • Red Hat Developer Hub 1
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Hardened Images
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift AI 3.4
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 5
  • Red Hat OpenShift Service Mesh 3.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-45820
  2. 2026-10-03 Alias added: GHSA-px8p-9vwx-vf98
  3. 2026-10-09 Fix available: RHSA-2026:79378 · Red Hat
  4. 2026-10-09 Fix available: Red Hat Ansible Automation Platform 2.7 · Red Hat
  5. 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
  6. 2026-10-20 Fix available: Red Hat OpenShift AI 3.4 · Red Hat
  7. 2026-10-21 Fix available: RHSA-2026:87004 · Red Hat
  8. 2026-10-21 Fix available: Red Hat Ansible Automation Platform 2.6 for RHEL 9 · Red Hat
  9. 2026-10-22 Fix available: RHSA-2026:87120 · Red Hat
  10. 2026-10-22 Fix available: RHSA-2026:87410 · Red Hat
  11. 2026-10-23 Fix available: Red Hat Ansible Automation Platform 2.6, Red Hat OpenShift AI 2.25 · Red Hat
  12. 2026-10-27 Affected versions changed · Red Hat
  13. 2026-10-30 Fix available: RHSA-2026:92510 · Red Hat
  14. 2026-10-30 Affected versions changed · Red Hat
  15. 2026-10-30 Affected versions changed · Red Hat

References

Patch 1

Advisory 1

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences