CVE-2026-32141 Details

A denial-of-service vulnerability has been identified in the 'flatted' package, specifically in versions prior to 3.4.0. The issue arises in the 'parse()' function, which employs a recursive 'revive()' phase to handle circular references in deserialized JSON. When the function processes a crafted payload containing deeply nested or self-referential '$' indices, the recursion can go too deep, causing a stack overflow that crashes the Node.js process. This vulnerability can be exploited by sending a single request with a specially designed payload, making it a significant concern for applications that use 'flatted' to parse untrusted input.

Users can upgrade to 'flatted' version 3.4.0 or later, where this vulnerability has been fixed.