high
advisory
fflate: Memory corruption in unzipSync (CVE-2026-122146)
A memory corruption vulnerability has been identified in 101arrowz fflate up to version 0.8.3 within the unzipSync function.
CVE search metadata
CVE search record: CVE-2026-122146. Severity: high. CVSS: 7.3. KEV: no. Product: fflate (<= 0.8.3). Brief: fflate: Memory corruption in unzipSync (CVE-2026-122146). Brief link: https://feed.craftedsignal.io/briefs/2026-11-fflate-memory-corruption/
Triage facts
Revision 1- Applicability
- fflate (<= 0.8.3)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 5, 04:27 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
A weakness exists in 101arrowz fflate up to version 0.8.3. The issue affects the unzipSync function in esm/index.mjs and causes memory corruption. The attack can be initiated remotely, and public exploit code is available. The vendor did not respond to initial disclosure attempts.