Description
flatted’s parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process.
Recommendation
Update the flatted package to the latest compatible version. Followings are version details:
- Affected version(s): < 3.4.0
- Patched version(s): 3.4.0
References
Could your website be exposed too?
SmartScanner can check your website for flatted vulnerable to unbounded recursion DoS in parse() revive phase and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Axios: unbounded recursion in toFormData causes DoS via deeply nested request data - CVE-2026-42039
- React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint - CVE-2026-42342
- Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack - CVE-2026-27601
- Mermaid radar diagrams are vulnerable to DoS - CVE-2026-71439
You might also like:
See something that needs correcting? Let us knowUpdated March 13, 2026