CVE-2026-32141
EUVD-2026-1165312.03.2026, 18:16
flatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process. This vulnerability is fixed in 3.4.0.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| webreflection | flatted | 𝑥 < 3.4.0 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| Red Hat | Cluster Observability Operator 1.5.0 | 1782839279 ≤ 𝑥 < * | ADP |
| Red Hat | Cluster Observability Operator 1.5.0 | 1782840539 ≤ 𝑥 < * | ADP |
| Red Hat | Cluster Observability Operator 1.5.0 | 1782839996 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Developer Hub 1.8 | 1776784286 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Developer Hub 1.9 | 1777903262 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Edge Manager 1.0 | 1783502765 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Edge Manager 1.0 | 1783502438 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Edge Manager 1.1 | 1784194938 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Edge Manager 1.1 | 1784194574 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Edge Manager 1.1 | 1784126822 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Edge Manager 1.1 | 1784127736 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 2.16 | 1774282136 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Dev Spaces 3.28 | 1779341289 ≤ 𝑥 < * | ADP |
Debian Releases
Ubuntu Releases
Common Weakness Enumeration
- CWE-674 - Uncontrolled RecursionThe product does not properly control the amount of recursion which takes place, consuming excessive resources, such as allocated memory or the program stack.
- CWE-770 - Allocation of Resources Without Limits or ThrottlingThe software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
References