← CVE Intelligence

CVE-2026-32141

flatted: Unbounded recursion DoS in parse() revive phase PUBLISHED

Description (CNA)

flatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process. This vulnerability is fixed in 3.4.0.

Affected (CNA)

Vendor / productVersions
WebReflection / flattedaffected < 3.4.0

CWE

CWE-674

References

ADP enrichment

CISA-ADP

No English description supplied.

redhat-SADP

A denial of service flaw has been discovered in the flatted npm library. flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process.