CVE-2026-32141
High
Description
flatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process. This vulnerability is fixed in 3.4.0.
SeverityHigh
CVSS7.5
Exploit probability—
ProductWebreflection Flatted
PublishedMar 12, 2026
First seenMar 12, 2026
Weakness typeCWE-674CWE-674
How to fix
Update
- webreflection flatted3.4.0 or later
- flatted3.4.0 or later
Vendor advisories
- access.redhat.com/errata/RHSA-2026:34342
- access.redhat.com/errata/RHSA-2026:9742
- access.redhat.com/errata/RHSA-2026:13826
- access.redhat.com/errata/RHSA-2026:36651
- access.redhat.com/errata/RHSA-2026:40945
- access.redhat.com/errata/RHSA-2026:40118
- access.redhat.com/errata/RHSA-2026:5807
- access.redhat.com/errata/RHSA-2026:21772
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| webreflection flatted | v < 3.4.0 | 3.4.0 |
| flattednpm | v < 3.4.0 | 3.4.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.