---
id: CVE-2026-32141
title: flatted is a circular JSON parser
summary: >-
  flatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function
  uses a recursive revive() phase to resolve circular references in deserialized
  JSON. When given a crafted payload with deeply nested or self-referential $
  indi…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-674
  - CWE-770
vendor: webreflection
product: flatted
affected:
  - flatted < 3.4.0
patched:
  - flatted 3.4.0
published: '2026-03-12'
updated: '2026-07-02'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-32141'
references:
  - url: >-
      https://github.com/WebReflection/flatted/commit/7eb65d857e1a40de11c47461cdbc8541449f0606
    label: security-advisories@github.com
  - url: 'https://github.com/WebReflection/flatted/pull/88'
    label: security-advisories@github.com
  - url: >-
      https://github.com/WebReflection/flatted/security/advisories/GHSA-25h7-pfq9-p65f
    label: security-advisories@github.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:13826'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:21772'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:34342'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:5807'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:9742'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/security/cve/CVE-2026-32141'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2447083'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: >-
      https://github.com/WebReflection/flatted/security/advisories/GHSA-25h7-pfq9-p65f
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32141.json
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-32141'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-32141'
  - url: 'https://access.redhat.com/errata/RHSA-2026:36651'
  - url: 'https://access.redhat.com/errata/RHSA-2026:40945'
  - url: 'https://access.redhat.com/errata/RHSA-2026:40118'
  - url: 'https://access.redhat.com/errata/RHSA-2026:86618'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
epss: 0.00821
epssPercentile: 0.57098
ingestedAt: '2026-07-02T12:34:40.364Z'
---

## Overview

flatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process. This vulnerability is fixed in 3.4.0.

## Affected

- `flatted < 3.4.0`

## Remediation

Upgrade past the affected range:

- `flatted 3.4.0`

## Vendor advisories

- **RHSA-2026:34342** · Red Hat · fixed in: Cluster Observability Operator 1.5.3 · released 2026-07-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:34342)
- **RHSA-2026:9742** · Red Hat · fixed in: Red Hat Developer Hub 1.8 · released 2026-04-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:9742)
- **RHSA-2026:13826** · Red Hat · fixed in: Red Hat Developer Hub 1.9 · released 2026-05-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:13826)
- **RHSA-2026:36651** · Red Hat · fixed in: Red Hat Edge Manager 1.0 · released 2026-07-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:36651)
- **RHSA-2026:40945** · Red Hat · fixed in: Red Hat Edge Manager 1.1 · released 2026-07-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:40945)
- **RHSA-2026:40118** · Red Hat · fixed in: Red Hat Edge Manager 1.1 · released 2026-07-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:40118)
- **RHSA-2026:5807** · Red Hat · fixed in: Red Hat OpenShift AI 2.16 · released 2026-03-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:5807)
- **RHSA-2026:21772** · Red Hat · fixed in: Red Hat OpenShift Dev Spaces 3.28 · released 2026-05-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:21772)
- **Red Hat VEX** · Important · affected: Logging Subsystem for Red Hat OpenShift, Red Hat 3scale API Management Platform 2, Red Hat Ansible Automation Platform 2, Red Hat build of Apicurio Registry 2, Red Hat Data Grid 8, Red Hat Fuse 7, … · no fix planned: Logging Subsystem for Red Hat OpenShift, Red Hat 3scale API Management Platform 2, Red Hat Fuse 7, streams for Apache Kafka 2, … · updated 2026-10-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32141.json)
- **RHSA-2026:86618** · Red Hat · fixed in: Red Hat Ceph Storage 9.2 · released 2026-10-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:86618)