CVE-2026-27601: Underscore Package Suffers from Unlimited Recursion Vulnerability Leading to Potential DoS Attack
Summary
CVE-2026-27601: Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack. Affects underscore versions < 1.13.8. Fixed in 1.13.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Underscore is a popular JavaScript utility library that provides functional programming helpers for tasks such as manipulating arrays, objects, and functions. It is widely used in web development to simplify coding tasks and improve code readability. However, versions up to 1.13.7 of Underscore are vulnerable to a critical issue that can lead to Denial of Service (DoS) attacks due to unlimited recursion in its functions.
Vulnerability Detail
The vulnerability arises from the use of recursion without a depth limit in the Underscore functions _.flatten and _.isEqual. Under specific conditions, an attacker can exploit this flaw to cause a stack overflow, resulting in application crashes. This can occur when untrusted input is used to create deeply nested data structures, which are then processed by these functions. If the application does not handle exceptions from these calls, it can lead to significant downtime, especially in server applications where continuous operation is crucial.
How To Fix
Minimum fixed version
1.13.8
This is the first release that contains the fix.
npm install underscore@1.13.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, enforce a depth limit on the data structures created from untrusted input. For example, you can limit the depth to 1000 levels to prevent stack overflow attacks. Additionally, when using _.flatten, you can pass a second argument to limit the flattening depth, like so: `
_.flatten(nested, 1000);
`.
Conclusion
The vulnerability identified as CVE-2026-27601 in the Underscore package poses a significant risk due to unlimited recursion in critical functions. Upgrading to version 1.13.8 or later is essential to mitigate this risk. Implementing workarounds can provide temporary relief while ensuring application stability.
See every vulnerability recorded for underscore →
FAQ
The CVSS score of this vulnerability is 8.2, indicating a high severity level.
All versions of Underscore up to and including 1.13.7 are affected by this vulnerability.
Applications that rely on continuous operation, such as server applications, are most at risk, as they can be disrupted by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If an immediate upgrade is not possible, implement the suggested workarounds to enforce depth limits on untrusted input and limit the flattening depth in your code.
References
Related vulnerabilities
Recent vulnerabilities recorded for underscore.
