Live › vulnerability › CVE-2026-119051
The flat npm package, through version 6.0.1, lets an attacker supply keys like a.4294967294 to unflatten(), which creates a huge sparse array. Iterating that array with forEach, spread or JSON.stringify blocks the Node.js event loop, causing a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 14:25 UTC. All times on this page are UTC.
Applications that call unflatten() from flat 6.0.1 or earlier on untrusted input, such as request bodies or query strings, are exposed. Projects that only flatten trusted internal data, or that do not use flat, can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| flat | npm | <= 6.0.1 | – |
npm ls flat : any version up to 6.0.1 (including the latest) is affected, and it is often a transitive dependencyunflatten( imports from 'flat' fed by request bodies, query strings, or uploaded JSON/config. Keys like a.4294967294 are the trigger.6.0.1, the affected versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
flat through 6.0.1 contains an uncontrolled resource allocation vulnerability in unflatten() that allows attackers to create huge sparse arrays via unbounded numeric keys. Attackers can supply flattened keys such as a.4294967294, causing iteration with forEach, spread or JSON.stringify to block the Node.js event loop.
This page as .md · .json · in your agent: get_signal("CVE-2026-119051")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.