{"id":"CVE-2026-32141","title":"flatted is a circular JSON parser","summary":"flatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indi…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-674","CWE-770"],"vendor":"webreflection","product":"flatted","affected":["flatted < 3.4.0"],"patched":["flatted 3.4.0"],"published":"2026-03-12","updated":"2026-07-02","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-32141","references":[{"url":"https://github.com/WebReflection/flatted/commit/7eb65d857e1a40de11c47461cdbc8541449f0606","label":"security-advisories@github.com"},{"url":"https://github.com/WebReflection/flatted/pull/88","label":"security-advisories@github.com"},{"url":"https://github.com/WebReflection/flatted/security/advisories/GHSA-25h7-pfq9-p65f","label":"security-advisories@github.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:13826","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:21772","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:34342","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:5807","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:9742","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2026-32141","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447083","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://github.com/WebReflection/flatted/security/advisories/GHSA-25h7-pfq9-p65f","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32141.json","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-32141"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32141"},{"url":"https://access.redhat.com/errata/RHSA-2026:36651"},{"url":"https://access.redhat.com/errata/RHSA-2026:40945"},{"url":"https://access.redhat.com/errata/RHSA-2026:40118"},{"url":"https://access.redhat.com/errata/RHSA-2026:86618"}],"tags":["nvd","csaf","vex","red-hat"],"epss":0.00821,"epssPercentile":0.57098,"ingestedAt":"2026-07-02T12:34:40.364Z","slug":"CVE-2026-32141","body":"## Overview\n\nflatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process. This vulnerability is fixed in 3.4.0.\n\n## Affected\n\n- `flatted < 3.4.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `flatted 3.4.0`\n\n## Vendor advisories\n\n- **RHSA-2026:34342** · Red Hat · fixed in: Cluster Observability Operator 1.5.3 · released 2026-07-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:34342)\n- **RHSA-2026:9742** · Red Hat · fixed in: Red Hat Developer Hub 1.8 · released 2026-04-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:9742)\n- **RHSA-2026:13826** · Red Hat · fixed in: Red Hat Developer Hub 1.9 · released 2026-05-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:13826)\n- **RHSA-2026:36651** · Red Hat · fixed in: Red Hat Edge Manager 1.0 · released 2026-07-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:36651)\n- **RHSA-2026:40945** · Red Hat · fixed in: Red Hat Edge Manager 1.1 · released 2026-07-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:40945)\n- **RHSA-2026:40118** · Red Hat · fixed in: Red Hat Edge Manager 1.1 · released 2026-07-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:40118)\n- **RHSA-2026:5807** · Red Hat · fixed in: Red Hat OpenShift AI 2.16 · released 2026-03-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:5807)\n- **RHSA-2026:21772** · Red Hat · fixed in: Red Hat OpenShift Dev Spaces 3.28 · released 2026-05-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:21772)\n- **Red Hat VEX** · Important · affected: Logging Subsystem for Red Hat OpenShift, Red Hat 3scale API Management Platform 2, Red Hat Ansible Automation Platform 2, Red Hat build of Apicurio Registry 2, Red Hat Data Grid 8, Red Hat Fuse 7, … · no fix planned: Logging Subsystem for Red Hat OpenShift, Red Hat 3scale API Management Platform 2, Red Hat Fuse 7, streams for Apache Kafka 2, … · updated 2026-10-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32141.json)\n- **RHSA-2026:86618** · Red Hat · fixed in: Red Hat Ceph Storage 9.2 · released 2026-10-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:86618)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}