---
id: CVE-2026-119051
title: flat through 6.0.1 Denial of Service via unflatten() Numeric Array Index Keys
summary: >-
  flat through 6.0.1 contains an uncontrolled resource allocation vulnerability
  in unflatten() that allows attackers to create huge sparse arrays via
  unbounded numeric keys. Attackers can supply flattened keys such as
  a.4294967294, causing…
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-770
vendor: hughsk
product: flat
affected:
  - flat <= 6.0.1
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-03T15:30:32.469907Z'
exploitAvailable: true
published: '2026-10-29'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T15:30:53.029Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119051'
references:
  - url: 'https://github.com/hughsk/flat/issues/195'
    label: 'GitHub Issue #195'
  - url: 'https://github.com/hughsk/flat'
  - url: >-
      https://github.com/hughsk/flat/blob/1d68e1d06c0210cff31e5c61ac177f3e2d3fa564/index.js#L65-L75
  - url: >-
      https://github.com/hughsk/flat/blob/1d68e1d06c0210cff31e5c61ac177f3e2d3fa564/index.js#L137-L142
  - url: >-
      https://www.vulncheck.com/advisories/flat-through-6.0.1-denial-of-service-via-unflatten-numeric-array-index-keys
    label: >-
      VulnCheck Advisory: flat through 6.0.1 Denial of Service via unflatten()
      Numeric Array Index Keys
tags:
  - cve.org
  - exploit-available
epss: 0.0032
epssPercentile: 0.25111
ingestedAt: '2026-11-01T18:59:04.480Z'
---

## Overview

flat through 6.0.1 contains an uncontrolled resource allocation vulnerability in unflatten() that allows attackers to create huge sparse arrays via unbounded numeric keys. Attackers can supply flattened keys such as a.4294967294, causing iteration with forEach, spread or JSON.stringify to block the Node.js event loop.

## Affected

- `flat <= 6.0.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.