CVE-2026-32141

Published: Mar 12, 2026 Last Modified: Mar 12, 2026
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 7,5
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: none
Availability: high

Description

AI Translation Available

flatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process. This vulnerability is fixed in 3.4.0.

674

Uncontrolled Recursion

Draft
Abstraction: Class Structure: Simple
Common Consequences
Security Scopes Affected:
Availability Confidentiality
Potential Impacts:
Dos: Resource Consumption (Cpu) Dos: Resource Consumption (Memory) Read Application Data
Applicable Platforms
All platforms may be affected
View CWE Details
https://github.com/WebReflection/flatted/commit/7eb65d857e1…
https://github.com/WebReflection/flatted/commit/7eb65d857e1a40de11c47461cdbc854…
https://github.com/WebReflection/flatted/pull/88
https://github.com/WebReflection/flatted/pull/88
https://github.com/WebReflection/flatted/security/advisorie…
https://github.com/WebReflection/flatted/security/advisories/GHSA-25h7-pfq9-p65f