A newly disclosed flaw in fflate, a widely used JavaScript library for zip compression, affects the unzipSync function and can trigger memory corruption when handling a malicious archive. NVD tracks the issue as CVE-2026-122146 and notes it can be triggered remotely, with a working exploit already circulating publicly. The library's maintainers were reportedly notified ahead of disclosure but did not respond.
// source: nvd.nist.gov ↗