Vulnerabilities

 1 via 1 paths

Dependencies

 212

Source

 GitHub

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Issue type
  • 1
  • 1
Severity
  • 1
  • 1
Status
  • 2
  • 0
  • 0

high severity
new

Memory Allocation with Excessive Size Value

  • Vulnerable module: fflate
  • Introduced through: astro-icon@1.2.0

Detailed paths

  • Introduced through: @arthelokyo/astrowind@onwidget/astrowind › astro-icon@1.2.0 › @iconify/tools@5.0.14 › fflate@0.8.3

Overview

fflate is a High performance (de)compression in an 8kB package

Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the unzipSync function in src/index.ts. An attacker can supply a crafted ZIP archive whose entry declares an extremely large uncompressed size, causing unzipSync to allocate an enormous output buffer and exhaust the application’s memory. The supported impact is memory exhaustion, which can make the application fail during extraction.

Remediation

There is no fixed version for fflate.

References

Memory Allocation with Excessive Size Value vulnerability report

medium severity

MPL-2.0 license

  • Module: lightningcss
  • Introduced through: astro@7.4.12

Detailed paths

  • Introduced through: @arthelokyo/astrowind@onwidget/astrowind › astro@7.4.12 › vite@8.3.8 › lightningcss@1.33.0

MPL-2.0 license

MPL-2.0 license vulnerability report