CVE-2026-32141

HighCVSS 7.5

Published: 12/03/2026(UTC)Updated: 04/09/2026(UTC)Translated: 18/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.81%

54th percentile - higher than 54% of all known CVEs

Summary

The flatted circular JSON parser library has a stack overflow vulnerability. The parse() function uses a recursive revive() phase to resolve circular references, and a crafted payload with deeply nested or self-referential $ indices causes unbounded recursion, crashing the Node.js process.

Risk Assessment

An attacker can remotely crash a Node.js application using flatted to parse untrusted JSON data, leading to denial of service (DoS).

Recommendation

Immediately update the flatted library to version 3.4.0 or later, which includes a fix for the unbounded recursion.

Other vulnerabilities in flatted

CVE-2026-33228Critical
The flatted circular JSON parser before version 3.4.2 allows an attacker to inject the '__proto__' key as an array index, leaking a live reference to Array.prototype. This can lead to prototype pollution when the consumer writes to that property.

Original NVD description (English source)

flatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process. This vulnerability is fixed in 3.4.0.