CVE-2026-119051 Details

A denial-of-service vulnerability has been identified in the 'flat' package, specifically in versions through 6.0.1. The issue arises from an uncontrolled resource allocation in the 'unflatten()' function, where attackers can create large sparse arrays using unbounded numeric keys. This manipulation causes the Node.js event loop to become blocked, disrupting normal application performance. The vulnerability is rooted in the 'getkey()' function, which improperly handles numeric keys by allowing excessively large values to be used as array indices, without any upper limit.

As a temporary workaround, 'unflatten()' can be called with the '{ object: true }' option to prevent the creation of arrays from numeric keys. However, this should be done with caution, as it may not be suitable for all use cases.