CVE-2026-32141: flatted Denial of Service Vulnerability Due to Unbounded Recursion in parse() Function
Summary
CVE-2026-32141: flatted vulnerable to unbounded recursion DoS in parse() revive phase. Affects flatted versions < 3.4.0. Fixed in 3.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
flatted is a popular npm package used for circular JSON serialization, allowing for the encoding and decoding of JavaScript objects that contain circular references. It is widely utilized in various caching and logging libraries, boasting approximately 87 million weekly downloads. The package's functionality is crucial for applications that need to handle complex data structures, but it is susceptible to specific vulnerabilities that can be exploited by attackers.
Vulnerability Detail
The vulnerability arises from the parse() function in the flatted package, which employs a recursive revive() phase to resolve circular references in deserialized JSON. When an attacker provides a specially crafted payload containing deeply nested or self-referential $ indices, the recursion depth becomes unbounded. This leads to a stack overflow, causing the Node.js process to crash. The impact is a Denial of Service (DoS), allowing an unauthenticated attacker to crash any application that processes untrusted input through flatted.parse() with a single request.
How To Fix
Latest published version: 3.4.4 as of 23 Oct 2026
npm install flatted@3.4.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.4.0
This is the first release that contains the fix.
npm install flatted@3.4.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid passing untrusted input to the flatted.parse() function until you can update to the patched version. Additionally, you can implement input validation to ensure that the data being parsed does not contain deeply nested structures that could trigger the vulnerability.
Conclusion
The flatted package has a critical vulnerability (CVE-2026-32141) that can lead to Denial of Service due to unbounded recursion in its parse() function. It is essential to update to version 3.4.0 or later to mitigate this risk. Until then, avoid using untrusted input with the flatted.parse() function and consider implementing input validation.
See every vulnerability recorded for flatted →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application for this vulnerability using the Vulert playground without any signup at Vulert Scanner.
The primary consequence is a Denial of Service (DoS), where an attacker can crash your application by exploiting the vulnerability with a crafted payload.
Yes, a patch is available in version 3.4.0 of the flatted package. It is recommended to update to this version or later.
If you cannot update the package right away, ensure that you do not pass untrusted input to the flatted.parse() function and consider implementing input validation as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for flatted.
