CVE-2026-45820 (MEDIUM): detected in Lambda Docker Images.

## CVE Details

| **CVE ID** | **Severity** | **Affected Package** | **Installed Version** | **Fixed Version** | **Date Published** | **Date of Scan** |
|-----------------|--------------|----------------------|-----------------------|-------------------|--------------------|------------------|
| [CVE-2026-45820](https://avd.aquasec.com/nvd/cve-2026-45820) | `MEDIUM` | `fflate` | `0.8.1` | `0.4.9, 0.5.4, 0.6.11, 0.7.5, 0.8.3` | `2026-07-22T08:16:23.28Z` | `2026-09-08T10:18:27.628459991Z` |

---

## Affected Docker Images

| **Image Name** | **SHA** |
|-----------------------------|---------------------------------------|
| `public.ecr.aws/lambda/nodejs:latest` | `public.ecr.aws/lambda/nodejs@sha256:714062e39b13b681435277f1bd5fac16b87f4fdcb2e627ea1d36fb3b6a8fc708` |
| `public.ecr.aws/lambda/nodejs:24` | `public.ecr.aws/lambda/nodejs@sha256:714062e39b13b681435277f1bd5fac16b87f4fdcb2e627ea1d36fb3b6a8fc708` |
| `public.ecr.aws/lambda/nodejs:22` | `public.ecr.aws/lambda/nodejs@sha256:b9cf24b0bf7a294836962cc2c7ea349fb3bcb9ec6dfddf040ba42bf7c4330547` |

---

## Description

> fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring compressed_size=0xFFFFFFFF (ZIP64 sentinel) but missing the required ZIP64 extra field tag 0x0001 causes z64e() to loop indefinitely due to out-of-bounds reads returning undefined, which coerces to 0, keeping the loop condition permanently true.

---

### Remediation Steps
- Update the affected package `fflate` from version `0.8.1` to `0.4.9, 0.5.4, 0.6.11, 0.7.5, 0.8.3`.

### About this issue
- This issue may not contain all the information about the CVE nor the images it affects.
- This issue will not be updated with new information and the list of affected images may have changed since the creation of this issue.
- For more, visit [Lambda Watchdog](https://lambdawatchdog.com).
- This issue was created automatically by Lambda Watchdog.

No repository files or tests are identified; begin by locating how the listed Lambda Node.js Docker image digests are produced and where fflate 0.8.1 enters them. Confirm the affected images use a fixed fflate version such as 0.8.3 and verify that rebuilt images no longer report this CVE.

Written by the indexing model from the issue text.