CVE-2026-32141High· 7.5▾ Twilightflatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indi…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 4.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.8%
0.8% → 0.8%
flatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process. This vulnerability is fixed in 3.4.0.
flatted < 3.4.0Upgrade past the affected range:
flatted 3.4.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-1526High· 7.5The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression
CVE-2026-42039High· 7.5Axios is a promise based HTTP client for the browser and Node.js
CVE-2025-61726High· 7.5The net/url package does not set a limit on the number of query parameters in a query
CVE-2026-93687High· 7.5braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards
CVE-2026-73566High· 7.5node-tar is a tar archive manipulation library for Node.js
CVE-2026-16100Medium· 6.5A flaw was found in the user-event metrics recording of Keycloak