CVE-2026-32141High· 7.5▾ Twilightflatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indi…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.8%
0.8% → 1.0%
flatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process. This vulnerability is fixed in 3.4.0.
flatted < 3.4.0Upgrade past the affected range:
flatted 3.4.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-42039High· 7.5Axios is a promise based HTTP client for the browser and Node.js
CVE-2026-116144Low· 3.3ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Stack Overflow via MVG Decoder
CVE-2026-8168Medium· 6.5qt5-qtsvg: qt6-qtsvg: qt: Denial of Service via deeply nested SVG elements (CVE-2026-8168)
CVE-2026-110263Medium· 5.5OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in SignatureReader.parseType() that allows attackers to exhaust the stack via deeply nested generic type signatures
CVE-2026-106449Low· 3.7yawkat LZ4 Java provides LZ4 compression for Java
CVE-2026-83663High· 8.7Uncontrolled Recursion vulnerability in Apache Thrift go bindings. Both Go transports satisfy a read out of a buffered frame and, when that frame yields no payload bytes, read the next frame and call `Read` again instead of looping