flatted vulnerable to unbounded recursion DoS in parse() revive phase

Description

flatted’s parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process.

Recommendation

Update the flatted package to the latest compatible version. Followings are version details:

• Affected version(s): < 3.4.0
• Patched version(s): 3.4.0

References

• GHSA-25h7-pfq9-p65f
• CVE-2026-32141
• CWE-674
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Axios: unbounded recursion in toFormData causes DoS via deeply nested request data - CVE-2026-42039
• React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint - CVE-2026-42342
• Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack - CVE-2026-27601
• Mermaid radar diagrams are vulnerable to DoS - CVE-2026-71439

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

flatted