CVE-2026-119051
CVE-2026-119051 · flat through 6.0.1 Denial of Service via unflatten() Numeric Array Index Keys
This page contains facts from public vulnerability sources. Check the original advisory before updating.
flat through 6.0.1 contains an uncontrolled resource allocation vulnerability in unflatten() that allows attackers to create huge sparse arrays via unbounded numeric keys. Attackers can supply flattened keys such as a.4294967294, causing iteration with forEach, spread or JSON.stringify to block the Node.js event loop.
CVSS 8.2 · High · EPSS 0.3%
- Published
- Updated
Affected products and versions
flat
- Versions
- ≥ 0, ≤ 6.0.1: Affected (custom)
No fix published
Original sources
- https://github.com/hughsk/flat/issues/195
- https://github.com/hughsk/flat
- https://github.com/hughsk/flat/blob/1d68e1d06c0210cff31e5c61ac177f3e2d3fa564/index.js#L65-L75
- https://github.com/hughsk/flat/blob/1d68e1d06c0210cff31e5c61ac177f3e2d3fa564/index.js#L137-L142
- https://www.vulncheck.com/advisories/flat-through-6.0.1-denial-of-service-via-unflatten-numeric-array-index-keys
- https://nvd.nist.gov/vuln/detail/CVE-2026-119051