Threats affecting pkg:npm/101arrowz/fflate

CVE-2026-122146 is a memory corruption vulnerability in the unzipSync function of the esm/index.mjs file in 101arrowz fflate versions 0.8.0 through 0.8.3. The flaw can be exploited remotely and public exploit code is available. The vendor has not responded to the disclosure. The CVSS 4.0 score is 6.9, indicating a medium severity.