CVE-2026-32141: CWE-674: Uncontrolled Recursion in WebReflection flatted
flatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process. This vulnerability is fixed in 3.4.0.
AI Analysis
Technical Summary
CVE-2026-32141 affects the WebReflection flatted library, a circular JSON parser. Versions before 3.4.0 use a recursive revive() function during parsing to handle circular references. When processing maliciously crafted JSON payloads containing deeply nested or self-referential $ indices, the recursion depth is unbounded, leading to a stack overflow and crashing the Node.js process. This denial-of-service condition is addressed by the fix introduced in version 3.4.0.
Potential Impact
Exploitation of this vulnerability results in a denial-of-service condition by crashing the Node.js process running the flatted parser. There is no impact on confidentiality or integrity, but availability is severely affected due to the stack overflow caused by uncontrolled recursion.
Mitigation Recommendations
A fix is available in flatted version 3.4.0. Users and administrators should upgrade to version 3.4.0 or later to remediate this vulnerability. Patch status is confirmed by the vendor advisory. No additional mitigations are specified.
CVE-2026-32141: CWE-674: Uncontrolled Recursion in WebReflection flatted
Description
flatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process. This vulnerability is fixed in 3.4.0.
CVSS v3.1
Score 7.5high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-32141 affects the WebReflection flatted library, a circular JSON parser. Versions before 3.4.0 use a recursive revive() function during parsing to handle circular references. When processing maliciously crafted JSON payloads containing deeply nested or self-referential $ indices, the recursion depth is unbounded, leading to a stack overflow and crashing the Node.js process. This denial-of-service condition is addressed by the fix introduced in version 3.4.0.
Potential Impact
Exploitation of this vulnerability results in a denial-of-service condition by crashing the Node.js process running the flatted parser. There is no impact on confidentiality or integrity, but availability is severely affected due to the stack overflow caused by uncontrolled recursion.
Mitigation Recommendations
A fix is available in flatted version 3.4.0. Users and administrators should upgrade to version 3.4.0 or later to remediate this vulnerability. Patch status is confirmed by the vendor advisory. No additional mitigations are specified.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-03-10T22:19:36.546Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-32141","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:9742","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:13826","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:5807","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:21772","vendor":"Red Hat"}]
Threat ID: 69b302c82f860ef943d65df6
Added to database: 03/12/2026, 18:15:36 UTC
Last enriched: 07/22/2026, 22:54:42 UTC
Last updated: 07/31/2026, 19:22:58 UTC
Views: 284
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.