CVE Feed

    Dashboard / CVE / CVE-2026-32141

    CVE-2026-32141

    flatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process. This vulnerability is fixed in 3.4.0.

    Published:Mar 12, 2026
    Last Modified:Mar 20, 2026
    EPS:Mar 12, 2026
    EPSS Score:0.00041
    CVSS Score:7.5

    Affected Products

    Vendor
    Webreflection
    Product
    Flatted

    Exploits

    https://github.com/WebReflection/flatted/security/advisories/GHSA-25h7-pfq9-p65fhttps://github.com/WebReflection/flatted/security/advisories/GHSA-25h7-pfq9-p65f

    References

    https://github.com/WebReflection/flatted/commit/7eb65d857e1a40de11c47461cdbc8541449f0606
    https://github.com/WebReflection/flatted/pull/88
    https://github.com/WebReflection/flatted/security/advisories/GHSA-25h7-pfq9-p65f
    https://access.redhat.com/errata/RHSA-2026:13826
    https://access.redhat.com/errata/RHSA-2026:21772
    https://access.redhat.com/errata/RHSA-2026:34342
    https://access.redhat.com/errata/RHSA-2026:36651
    https://access.redhat.com/errata/RHSA-2026:40118
    https://access.redhat.com/errata/RHSA-2026:40945
    https://access.redhat.com/errata/RHSA-2026:5807
    https://access.redhat.com/errata/RHSA-2026:9742
    https://access.redhat.com/security/cve/CVE-2026-32141
    https://bugzilla.redhat.com/show_bug.cgi?id=2447083
    https://github.com/WebReflection/flatted/security/advisories/GHSA-25h7-pfq9-p65f
    https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32141.json

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High