What is the CVSS score of EUVD-2026-11653?

EUVD-2026-11653 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

How to fix or mitigate EUVD-2026-11653?

Within 24 hours: Identify all systems and applications using flatted library and document their criticality. Within 7 days: Implement input validation and recursion depth limits as interim controls; contact vendor for patch timeline and availability. Within 30 days: Upgrade to patched version when released or replace the library with an alternative JSON parser if no patch is available.

Flatted EUVD-2026-11653

Q: Which versions of Flatted are affected by EUVD-2026-11653?

A high-severity vulnerability in the flatted JSON parsing library (versions ≤3.4.0) allows attackers to cause denial of service through uncontrolled recursion.. A patch is available.

| CVE-2026-32141 HIGH

Uncontrolled Recursion (CWE-674)

2026-03-12 security-advisories@github.com

GHSA-25h7-pfq9-p65f

Denial Of Service Node.js Flatted

7.5

CVSS 3.1 · Vendor: github

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Craft deeply nested circular reference JSON
Exploit

Send payload to flatted parse() function
Execution

Trigger unbounded recursion in revive()
Impact

Stack overflow crashes Node.js process

Vulnerability Assessment

Weakness	CWE CWE-674 OWASP Top 10:2025 A06:2021 - Vulnerable and Outdated Components ASVS 5.0 V15 - Secure Coding and Architecture Recursion depth limits
Exploitation Conditions	Application must use flatted library version prior to 3.4.0 with parse() function exposed to untrusted JSON input, no special authentication or configuration required for remote exploitation.
Impact	CVSS 7.5 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: None. User interaction: None.
Exploit ScenarioDerived	An attacker could exploit this vulnerability to compromise the affected system.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

flatted is a circular JSON parser. versions up to 3.4.0 is affected by uncontrolled recursion (CVSS 7.5).

RemediationAI

Fixed in version 3.4.0.. Restrict network access to the affected service where possible.

Affected VersionsENISA

flatted < 3.4.0

Affected Packages

npm flatted fix: 3.4.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

This vulnerability (CWE-674: Uncontrolled Recursion) affects flatted is a circular JSON parser.. flatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process. This vulnerability is fixed in 3.4.0.

Know when Flatted gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (github) PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Red Hat 7.5 HIGH

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

CVE Published

Mar 12, 2026 - 18:16 nvd

HIGH 7.5

DescriptionCVE.org

flatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process. This vulnerability is fixed in 3.4.0.

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

5 npm packages depend on flatted (2 direct, 3 indirect)

Ecosystem-wide dependent count for version 3.4.0.

Executive ViewAI

Why It Matters

A high-severity vulnerability in the flatted JSON parsing library (versions ≤3.4.0) allows attackers to cause denial of service through uncontrolled recursion. Any application or service using this library is at risk of crashes and service interruptions, potentially affecting customer availability and business operations.

Business Impact: High

Compensating Controls

Implement strict input validation to reject deeply nested JSON structures; deploy WAF rules to detect and block malformed JSON payloads; enable resource limits and timeout controls on parsing operations; consider network segmentation to isolate affected services; monitor for abnormal CPU and memory consumption indicative of recursion attacks; evaluate alternative JSON parsing libraries without this vulnerability.

Threat Intelligence Overview

EPSS Score

0.0%

Top 89% exploitable

Data Quality

7 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS Vendor

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.