Seal Security

fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring compressed size=0xFFFFFFFF (ZIP64 sentinel) but missing the required ZIP64 extra field tag 0x0001 causes z64e() to loop indefinitely due to out-of-bounds reads returning undefined, which coerces to 0, keeping the loop condition permanently true.

**Name of the Vulnerable Software and Affected Versions** decode-uri-component versions 0.4.1 and earlier **Description** A denial of service issue exists where the `decode()` function splits input based on the '%' character, creating N tokens that are then processed by `decodeComponents()`. This process results in super-linear parsing time, where increasing the number of tokens significantly increases processing time (e.g., 200 tokens take 0.7s, while 1400 tokens take 33s). An attacker can exploit this by providing crafted input to cause high CPU consumption and block the event-loop. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.