CVE-2026-122146
Deferred Deferred - Pending Action

Memory Corruption in 101arrowz fflate

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: VulDB

Description
A weakness has been identified in 101arrowz fflate up to 0.8.3. This issue affects the function unzipSync of the file esm/index.mjs. This manipulation causes memory corruption. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-05
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-122146
EUVD
EUVD-2026-117202

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
101arrowz fflate 0.8.0
101arrowz fflate 0.8.1
101arrowz fflate 0.8.2
101arrowz fflate 0.8.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-122146 is a memory corruption vulnerability in the fflate library version 0.8.3. It affects the unzipSync function in the file esm/index.mjs. The issue occurs because the function allocates memory based on uncompressed sizes declared in ZIP archives without proper validation or upper bounds. This can lead to excessive memory requests, such as a small archive requesting hundreds of gigabytes of memory.

Detection Guidance

To detect this vulnerability, inspect systems using fflate 0.8.3 or earlier for memory exhaustion during ZIP file processing. Check for excessive memory usage when unzipping files, especially those with large declared uncompressed sizes. Review logs for crashes or slowdowns during unzipSync operations.

Impact Analysis

This vulnerability can cause memory exhaustion attacks, leading to denial-of-service conditions on systems using affected versions of the fflate library. Attackers could exploit it remotely by providing specially crafted ZIP archives, potentially crashing applications or servers that process these files.

Mitigation Strategies

Upgrade fflate to a patched version. If unavailable, implement size validation checks before processing ZIP files. Use the filter callback to validate entry names and sizes. Set a maxOutputSize parameter to limit memory allocation. Avoid processing untrusted ZIP files until mitigated.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-122146. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...