CVE-2026-27601 affects underscore.js, a widely used JavaScript utility library, specifically versions before 1.13.8. The vulnerability arises from the _.flatten and _.isEqual functions employing recursion without enforcing a maximum depth limit. An attacker can exploit this by supplying untrusted input that forms deeply nested or recursive data structures, for example, via JSON.parse, which does not impose depth restrictions. In the case of _.flatten, exploitation requires that the input data structure consists solely of arrays at every level and that the function is called without a finite depth limit argument. For _.isEqual, exploitation requires a code path where two distinct but equivalent data structures originating from the same client are compared, such as when data submitted by a client is stored and later compared to new input from the same client, or when a single request is parsed twice resulting in two separate but equivalent objects. When these functions process such crafted data, the uncontrolled recursion can cause a stack overflow, leading to unhandled exceptions and application crashes, effectively resulting in a Denial of Service (DoS). The vulnerability does not require authentication or user interaction and can be triggered remotely over the network. The issue is classified under CWE-770 (Allocation of Resources Without Limits or Throttling). The vulnerability was publicly disclosed on March 3, 2026, and fixed in underscore.js version 1.13.8. No known exploits are reported in the wild yet, but the high CVSS score (8.2) indicates a significant risk to availability for affected applications.

The primary impact of CVE-2026-27601 is Denial of Service (DoS) due to stack overflow exceptions caused by uncontrolled recursion in underscore.js functions. Organizations using vulnerable versions of underscore.js in their web applications, especially those that accept and process deeply nested or recursive JSON data from untrusted sources, may experience application crashes or service outages. This can disrupt business operations, degrade user experience, and potentially lead to loss of revenue or reputation damage. Since underscore.js is a popular utility library embedded in many JavaScript applications worldwide, the scope of affected systems is broad. The vulnerability does not directly compromise confidentiality or integrity but severely impacts availability. Attackers can exploit this remotely without authentication or user interaction, increasing the risk of automated or large-scale DoS attacks. Applications that perform server-side data processing or comparison of client-submitted data structures are particularly vulnerable. The lack of exception handling for stack overflows exacerbates the impact, as it leads to ungraceful failures. Although no known exploits are currently reported, the vulnerability's characteristics make it a viable target for attackers aiming to disrupt services.

To mitigate CVE-2026-27601, organizations should upgrade underscore.js to version 1.13.8 or later, where the vulnerability is fixed. If immediate upgrade is not feasible, developers should implement strict input validation and sanitization to prevent deeply nested or recursive data structures from untrusted sources. Specifically, limit the depth of JSON parsing or reject inputs exceeding a safe nesting threshold. When using _.flatten, always provide a finite depth limit as the second argument to prevent unbounded recursion. For _.isEqual, avoid comparing two distinct data structures derived from untrusted input without prior validation or normalization. Implement robust exception handling around calls to _.flatten and _.isEqual to gracefully catch and manage potential stack overflow errors. Additionally, consider employing runtime monitoring and rate limiting on endpoints processing complex JSON data to detect and block suspicious activity indicative of DoS attempts. Conduct thorough code reviews to identify and refactor any code paths that may inadvertently compare or flatten untrusted recursive data structures. Finally, maintain up-to-date dependency management practices and monitor vulnerability advisories to promptly apply security patches.