CVE-2026-119051EUVD-2026-112817GHSA-476F-8CCP-82XP
flat through 6.0.1 Denial of Service via unflatten() Numeric Array Index Keys
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The flat npm package (versions up to 6.0.1, with versions omitted here) is affected. An attacker who can supply crafted keys to its unflatten() function can make it build huge sparse arrays, which then stalls the Node.js event loop and causes a denial of service.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
flat through 6.0.1 contains an uncontrolled resource allocation vulnerability in unflatten() that allows attackers to create huge sparse arrays via unbounded numeric keys. Attackers can supply flattened keys such as a.4294967294, causing iteration with forEach, spread or JSON.stringify to block the Node.js event loop.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- hughsk flat
through 6.0.1