PT-2026-25037 · Npm · Flatted
Byamb4
·
Published
2026-03-12
·
Updated
2026-05-18
·
CVE-2026-32141
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
flatted versions prior to 3.4.0
Description
flatted is a circular JSON parser. The
parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When provided with a crafted payload containing deeply nested or self-referential $ indices, the recursion depth becomes unbounded, leading to a stack overflow and crashing the Node.js process. This can result in a Denial of Service (DoS). The software has approximately 87 million weekly npm downloads and is used in many caching and logging libraries. The issue is triggered by passing untrusted input to the flatted.parse() function. A proof of concept demonstrates building a deeply nested circular reference chain to cause a stack overflow. The vulnerable component is the parse() function, which utilizes the revive() function.Recommendations
Versions prior to 3.4.0 should be updated to version 3.4.0 or later.
Exploit
Fix
Uncontrolled Recursion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Flatted