p PatchFirst

CVE-2026-32141

CVE-2026-32141 · flatted: Unbounded recursion DoS in parse() revive phase

This page contains facts from public vulnerability sources. Check the original advisory before updating.

flatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process. This vulnerability is fixed in 3.4.0.

CVSS 7.5 · High · EPSS 0.8% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • flatted

    Versions
    • < 3.4.0: Affected

    No fix published

  • node-flatted Debian:12

    Versions
    • 3.2.7~ds-1
    • 3.2.7~ds-1+deb12u1
    • 3.4.1~ds-1
    • 3.4.2~ds-1
    • 3.4.4~ds-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-flatted Debian:13

    Versions
    • 3.2.7~ds-1
    • 3.2.7~ds-1+deb13u1
    • 3.4.1~ds-1
    • 3.4.2~ds-1
    • 3.4.4~ds-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-flatted Debian:14

    Versions
    • 3.2.7~ds-1
    Affected ranges
    • ECOSYSTEM: < 3.4.1~ds-1

    Update to 3.4.1~ds-1

  • flatted npm

    Affected ranges
    • SEMVER: < 3.4.0

    Update to 3.4.0

  • node-flatted Ubuntu:20.04:LTS

    Versions
    • 2.0.1~dfsg-3
    • 2.0.1~dfsg-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-flatted Ubuntu:22.04:LTS

    Versions
    • 2.0.2~dfsg-1
    • 2.0.2~dfsg-4
    • 3.2.2~ds-2
    • 3.2.2~ds-3
    • 3.2.4~ds-1
    • 3.2.5~ds-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-flatted Ubuntu:24.04:LTS

    Versions
    • 3.2.7~ds-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-flatted Ubuntu:25.10

    Versions
    • 3.2.7~ds-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-flatted Ubuntu:26.10

    Versions
    • 3.4.2~ds-1
    • 3.4.4~ds-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-flatted Ubuntu:26.04:LTS

    Versions
    • 3.2.7~ds-1
    • 3.4.2~ds-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →