Description
A weakness has been identified in 101arrowz fflate up to 0.8.3. This issue affects the function unzipSync of the file esm/index.mjs. This manipulation causes memory corruption. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-11-05
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: Remote Memory Corruption
Action: Immediate Patch
AI Analysis

Impact

The fflate library exposes a memory corruption vulnerability in the unzipSync function of esm/index.mjs. By manipulating compressed data processed by this function, an attacker can corrupt memory. The weakness is classified as CWE‑119, indicating classic buffer overflow or similar memory corruption behavior.

Affected Systems

This flaw affects the 101arrowz fflate package up through version 0.8.3. Versions later than 0.8.3 have not been reported to contain the issue, but no confirmation of a fix is available in the provided data.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity. No EPSS value is available. The vulnerability is not listed in the CISA KEV catalog. The description states that the exploit is publicly available and can be initiated remotely. Thus, remote exploitation is possible, but the overall risk depends on the presence of the vulnerable library in exposed code paths.

Generated by OpenCVE AI on November 5, 2026 at 02:50 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the fflate library to a version newer than 0.8.3 if one is available, or apply any vendor‑supplied patch that addresses the memory corruption in unzipSync.
  • If an upgrade is not possible, remove or isolate the use of the vulnerable unzipSync function—reject compressed input from untrusted sources or replace the function with a safer, validated alternative.
  • Enable runtime security hardening such as ASLR, stack canaries, and memory protection mechanisms to mitigate the impact of potential buffer overflows when the vulnerable code executes.

Generated by OpenCVE AI on November 5, 2026 at 02:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 05 Nov 2026 01:00:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in 101arrowz fflate up to 0.8.3. This issue affects the function unzipSync of the file esm/index.mjs. This manipulation causes memory corruption. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Title 101arrowz fflate index.mjs unzipSync memory corruption
First Time appeared 101arrowz
101arrowz fflate
Weaknesses CWE-119
CPEs cpe:2.3:a:101arrowz:fflate:*:*:*:*:*:*:*:*
Vendors & Products 101arrowz
101arrowz fflate
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

101arrowz Fflate
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-11-05T00:45:26.038Z

Reserved: 2026-11-04T18:21:49.726Z

Link: CVE-2026-122146

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-11-05T01:17:22.143

Modified: 2026-11-05T01:17:22.313

Link: CVE-2026-122146

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-05T03:00:16Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer