Underscore versions up to 1.13.7 contain a vulnerability in the _.flatten and _.isEqual functions where unlimited recursion can cause a stack overflow, leading to a denial of service (DoS). This occurs when deeply nested data structures from untrusted input are processed without depth limits. The issue is patched in version 1.13.8. Applications vulnerable to this attack are those that accept deeply nested untrusted input and use these functions without safeguards.