PT-2026-22841 · Unknown · Underscore.Js
Byamb4
·
Published
2026-03-03
·
Updated
2026-05-18
·
CVE-2026-27601
CVSS v4.0
8.2
High
| Vector | AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Underscore.js versions prior to 1.13.8
Description
Underscore.js, a JavaScript utility-belt library, contains an issue in the
.flatten and .isEqual functions. These functions utilize recursion without a depth limit, potentially leading to a Denial of Service (DoS) attack through stack overflow. Exploitation requires an attacker to provide untrusted input that creates a recursive data structure, such as using JSON.parse without a depth limit. For .flatten, the vulnerability is exploitable if the data structure consists of arrays at all levels and no finite depth limit is provided as an argument. For .isEqual, exploitation requires comparing two distinct data structures submitted by the same client, for example, data stored in a database compared to newly submitted data, or parsing the same data twice. Exceptions resulting from the stack overflow are not handled.Recommendations
Update Underscore.js to version 1.13.8 or later.
Exploit
Fix
DoS
Allocation of Resources Without Limits
Uncontrolled Recursion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Underscore.Js