What’s Vulnerable › Vulnerabilities

CVE-2026-32141: flatted: Unbounded recursion DoS in parse() revive phase

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-03-12 · updated 2026-09-04
• Weakness: CWE-674

Description

flatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process. This vulnerability is fixed in 3.4.0.

Affected products

• WebReflection flatted: before 3.4.0 — fixed in 3.4.0
• Npm Flatted: before 3.4.0 — fixed in 3.4.0

How to fix

Upgrade to a fixed version: WebReflection flatted 3.4.0; Npm Flatted 3.4.0. Check the vendor advisory for mitigations.

References

• https://github.com/WebReflection/flatted/commit/7eb65d857e1a40de11c47461cdbc8541449f0606
• https://github.com/WebReflection/flatted/pull/88
• https://github.com/WebReflection/flatted/security/advisories/GHSA-25h7-pfq9-p65f
• https://access.redhat.com/errata/RHSA-2026:13826
• https://access.redhat.com/errata/RHSA-2026:21772
• https://access.redhat.com/errata/RHSA-2026:34342
• https://access.redhat.com/errata/RHSA-2026:36651
• https://access.redhat.com/errata/RHSA-2026:40118
• https://access.redhat.com/errata/RHSA-2026:40945
• https://access.redhat.com/errata/RHSA-2026:5807
• https://access.redhat.com/errata/RHSA-2026:9742
• https://access.redhat.com/security/cve/CVE-2026-32141

Get alerted when CVE-2026-32141 or the next vulnerability affects your stack