The vulnerability is an infinite loop inside the unzipSync() function of the fflate library. A crafted ZIP archive that declares a compressed_size of 0xFFFFFFFF but omits the required ZIP64 extra field tag causes the z64e() routine to read undefined values. Because these resolve to 0, the loop never ends, resulting in a denial of service. The weakness is an example of uncontrolled resource consumption (CWE‑400) and an infinite loop (CWE‑835).

The flaw affects the fflate JavaScript compression library distributed by 101arrowz. All versions up to and including 0.8.2 are vulnerable. Systems that use fflate to extract ZIP files, particularly server‑side code or client applications that accept untrusted archives, are impacted.

The CVSS v3 base score of 6.6 places the issue in the medium severity range. The EPSS score is below 1 % and the vulnerability is not currently listed in the CISA KEV catalog, suggesting that exploitation is unlikely at present. Based on the description, it is inferred that if an attacker can supply a malicious ZIP file to a process that calls unzipSync(), the delivery of such a file will trigger the endless loop and freeze the process. Because the vulnerability requires only a specially crafted archive and does not rely on elevated privileges, remote exploitation is possible wherever fflate is used to decompress externally supplied data.