Vulnerability Description
flat through 6.0.1 contains an uncontrolled resource allocation vulnerability in unflatten() that allows attackers to create huge sparse arrays via unbounded numeric keys. Attackers can supply flattened keys such as a.4294967294, causing iteration with forEach, spread or JSON.stringify to block the Node.js event loop.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/hughsk/flat
- https://github.com/hughsk/flat/blob/1d68e1d06c0210cff31e5c61ac177f3e2d3fa564/ind
- https://github.com/hughsk/flat/blob/1d68e1d06c0210cff31e5c61ac177f3e2d3fa564/ind
- https://github.com/hughsk/flat/issues/195
- https://www.vulncheck.com/advisories/flat-through-6.0.1-denial-of-service-via-un
FAQ
What is CVE-2026-119051?
CVE-2026-119051 is a vulnerability with a CVSS score of 5.9 (MEDIUM). flat through 6.0.1 contains an uncontrolled resource allocation vulnerability in unflatten() that allows attackers to create huge sparse arrays via unbounded numeric keys. Attackers can supply flatten...
How severe is CVE-2026-119051?
CVE-2026-119051 has been rated MEDIUM with a CVSS base score of 5.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-119051?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.