flatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process. This vulnerability is fixed in 3.4.0.
| Version | Base score | Base severity | Vector |
|---|---|---|---|
| 3.1 | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
| Hyperlink | Resource |
|---|---|
| https://github.com/WebReflection/flatted/security/advisories/GHSA-25h7-pfq9-p65f | x_refsource_CONFIRM |
| https://github.com/WebReflection/flatted/pull/88 | x_refsource_MISC |
| https://github.com/WebReflection/flatted/commit/7eb65d857e1a40de11c47461cdbc8541449f0606 | x_refsource_MISC |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
| Hyperlink | Resource |
|---|---|
| https://github.com/WebReflection/flatted/security/advisories/GHSA-25h7-pfq9-p65f | exploit |
A denial of service flaw has been discovered in the flatted npm library. flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process.
| Version | Base score | Base severity | Vector |
|---|---|---|---|
| 3.1 | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| CAPEC ID | Description |
|---|
RHSA-2026:34342: Cluster Observability Operator 1.5.0
RHSA-2026:9742: Red Hat Developer Hub 1.8
RHSA-2026:13826: Red Hat Developer Hub 1.9
RHSA-2026:36651: Red Hat Edge Manager 1.0
RHSA-2026:40945: Red Hat Edge Manager 1.1
RHSA-2026:40118: Red Hat Edge Manager 1.1
RHSA-2026:5807: Red Hat OpenShift AI 2.16
RHSA-2026:21772: Red Hat OpenShift Dev Spaces 3.28
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
| Event | Date |
|---|---|
| Reported to Red Hat. | 2026-03-12 19:01:30 |
| Made public. | 2026-03-12 18:08:09 |
| Hyperlink | Resource |
|---|---|
| https://access.redhat.com/security/cve/CVE-2026-32141 | vdb-entry x_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2447083 | issue-tracking x_refsource_REDHAT |
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32141.json | x_sadp-csaf-vex |
| https://access.redhat.com/errata/RHSA-2026:34342 | vendor-advisory x_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:9742 | vendor-advisory x_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:13826 | vendor-advisory x_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:36651 | vendor-advisory x_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:40945 | vendor-advisory x_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:40118 | vendor-advisory x_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:5807 | vendor-advisory x_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:21772 | vendor-advisory x_refsource_REDHAT |