Flat
Monthly
Denial of service in the flat npm package (hughsk/flat) through 6.0.1 lets an attacker who can influence input passed to unflatten() exhaust Node.js resources by supplying a dotted key with a very large numeric array index, such as a.4294967294. The resulting huge sparse array only blocks the event loop when the application subsequently iterates or serializes the object via forEach, spread or JSON.stringify, so impact is availability-only with no confidentiality or integrity effect. The input assigns CVSS 4.0 base score 8.2 (High) and the priority decision is this_week; no public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV).
Denial of service in the flat npm package (hughsk/flat) through 6.0.1 lets an attacker who can influence input passed to unflatten() exhaust Node.js resources by supplying a dotted key with a very large numeric array index, such as a.4294967294. The resulting huge sparse array only blocks the event loop when the application subsequently iterates or serializes the object via forEach, spread or JSON.stringify, so impact is availability-only with no confidentiality or integrity effect. The input assigns CVSS 4.0 base score 8.2 (High) and the priority decision is this_week; no public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV).