flat through 6.0.1 contains an uncontrolled resource allocation vulnerability in unflatten() that allows attackers to create huge sparse arrays via unbounded numeric keys. Attackers can supply flattened keys such as a.4294967294, causing iteration with forEach, spread or JSON.stringify to block the Node.js event loop.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 8.2 · hughskNVD modified 2026-10-29 13:08
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 5
- https://github.com/hughsk/flat/issues/195 issue-tracking
- https://github.com/hughsk/flat product
- https://github.com/hughsk/flat/blob/1d68e1d06c0210cff31e5c61ac177f3e2d3fa564/index.js#L65-L75 technical-description
- https://github.com/hughsk/flat/blob/1d68e1d06c0210cff31e5c61ac177f3e2d3fa564/index.js#L137-L142 technical-description
- https://www.vulncheck.com/advisories/flat-through-6.0.1-denial-of-service-via-unflatten-numeric-array-index-keys third-party-advisory