EUVD-2026-112817
GHSA-476f-8ccp-82xp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSubmit crafted JSON with large numeric key
-
Exploitunflatten() allocates huge sparse array
-
ExecutionforEach/spread/JSON.stringify blocks Node.js event loop
-
Impactservice denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires two application-side preconditions, both drawn from the description: (1) the application must pass attacker-controlled data to flat's unflatten() function, and (2) a flattened key must contain a large unbounded numeric index (e.g. 'a.4294967294') that causes allocation of a huge sparse array, after which (3) the application must iterate or serialize the resulting object via forEach, spread, or JSON.stringify to actually block the event loop. Limiting factors: the impact is availability-only (no data disclosure or modification); applications that never unflatten untrusted input, or that do not subsequently iterate/serialize the output, are not exploitable; the CVSS AC:H/AT:P metrics reflect that success depends on this application processing path rather than a guaranteed single request. |
| Impact | The input assigns a CVSS 4.0 base score of 8.2 (High) with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N, which is driven entirely by an availability impact (VA:H) with zero confidentiality or integrity impact - this is a pure denial-of-service issue (CWE-770, uncontrolled resource allocation). Two signals temper the raw score: AC:H and AT:P indicate the attack is not trivially reliable and depends on an attack requirement beyond the attacker's control, consistent with the description, where the DoS only materializes if the application calls unflatten() on attacker-controlled input and then iterates or serializes the result (forEach, spread, or JSON.stringify). No EPSS score is provided in the input, so exploitation probability cannot be quantified. The CVE is NOT in CISA KEV, and the input contains no confirmed proof-of-concept flag, so there is no public exploit identified at time of analysis - though the referenced GitHub issue #195 and the linked source lines document the trigger mechanism. The vuln.today decision label is 'this_week', reflecting moderate rather than emergency urgency. Net: this is a genuine but conditional DoS in a widely-used library; it is a real priority for services that unflatten untrusted input, but it is confidentiality/integrity-neutral and gated on application behavior rather than a drop-everything emergency. |
| Exploit ScenarioDerived | An attacker submits a JSON payload containing a flattened key with a very large numeric index, such as 'a.4294967294', to an endpoint that passes the parsed body to flat's unflatten(). unflatten() allocates a huge sparse array sized to that index, and when the application then calls forEach, spread, or JSON.stringify on the result, the Node.js event loop blocks and the service becomes unresponsive. No public exploit is identified in the input, but the referenced GitHub issue documents the exact trigger. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 29, 2026
Denial of service in the flat npm package (hughsk/flat) through 6.0.1 lets an attacker who can influence input passed to unflatten() exhaust Node.js resources by supplying a dotted key with a very large numeric array index, such as a.4294967294. The resulting huge sparse array only blocks the event loop when the application subsequently iterates or serializes the object via forEach, spread or JSON.stringify, so impact is availability-only with no confidentiality or integrity effect. The input assigns CVSS 4.0 base score 8.2 (High) and the priority decision is this_week; no public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV).
RemediationAI
No vendor-released patch or fixed version is identified in the available data for flat through 6.0.1; the public references are the upstream issue at https://github.com/hughsk/flat/issues/195 and the VulnCheck advisory at https://www.vulncheck.com/advisories/flat-through-6.0.1-denial-of-service-via-unflatten-numeric-array-index-keys, which should be monitored for a release that bounds numeric key segments. Until then, the controls that map to the assessed preconditions are: do not pass untrusted input to unflatten() - resolve attacker-supplied keys against a fixed allowlist or keep unflatten() for trusted internal configuration only (trade-off: reduces flexibility for dynamic input shapes); reject or rewrite flattened keys whose numeric segments exceed a small maximum before parsing (trade-off: legitimate large-index keys, which are unusual in real payloads, would be refused); and avoid forEach, spread or JSON.stringify on objects produced from untrusted input, using bounded traversal instead (trade-off: requires auditing every consumer of the unflattened result). Because the impact is availability-only and the assessed exploitation conditions require both an attacker-controlled unflatten() call and a subsequent full traversal or serialization, prioritise inventory of Node.js services that call unflatten() on request data and apply the above controls ahead of scheduled dependency upgrades.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
flat is a widely used Node.js helper library that flattens nested objects into dotted keys and reverses the process with unflatten(), which walks each dot-delimited segment and rebuilds nested objects and arrays. The referenced source lines (index.js L65-L75 and L137-L142 at commit 1d68e1d) are where key segments are interpreted as numeric array indices. Because the index is accepted without an upper bound, a key such as a.4294967294 causes allocation of a sparse array whose length is near the 32-bit limit; the allocation itself is cheap, but any later full traversal of that structure - forEach, spread into a new array, or JSON.stringify - becomes an extremely long loop that monopolizes the event loop and stalls all other work on the process. The weakness class is CWE-770 (Allocation of Resources Without Limits or Throttling). The assessed vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H matches the CVSS 4.0 data in being driven entirely by availability impact; AC:H/AT:P reflect that a successful denial of service depends on the application actually feeding attacker-controlled flattened keys into unflatten() and then iterating or serializing the result, rather than a guaranteed single request against every deployment. The specific trigger path in a given application is not described in the available sources beyond these processing requirements.
Know when Flat gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Remotely reachable untrusted input (AV:N/PR:N/UI:N) but exploitation depends on the app unflattening then iterating the result (AC:H); impact is availability-only DoS (A:H, C/I:N).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
flat through 6.0.1 contains an uncontrolled resource allocation vulnerability in unflatten() that allows attackers to create huge sparse arrays via unbounded numeric keys. Attackers can supply flattened keys such as a.4294967294, causing iteration with forEach, spread or JSON.stringify to block the Node.js event loop.
Articles & Coverage 2
Executive ViewAI
A high-severity denial-of-service vulnerability in the widely used npm package 'flat' (versions through 6.0.1) can allow an attacker to stall Node.js applications by supplying malicious input that triggers resource exhaustion. This affects any service that processes untrusted data through the unflatten() function, potentially causing outages and disrupting business operations. Although no public exploit code or active exploitation has been observed, the broad use of this library means leadership should prioritize remediation to prevent availability incidents.
No vendor-released patch identified at time of analysis. Interim mitigations include input validation to reject dotted keys with numeric indices above a safe threshold (e.g., 10000), using a custom wrapper around unflatten() to enforce limits, avoiding iteration or serialization of unvalidated objects, and implementing rate limiting or resource quotas to reduce the impact of potential exploitation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB