{"id":"CVE-2026-119051","kind":"vulnerability","aliases":["CVE-2026-119051"],"related":[],"title":"flat: unflatten() lets crafted keys stall Node.js event loop","description":"flat through 6.0.1 contains an uncontrolled resource allocation vulnerability in unflatten() that allows attackers to create huge sparse arrays via unbounded numeric keys. Attackers can supply flattened keys such as a.4294967294, causing iteration with forEach, spread or JSON.stringify to block the Node.js event loop.","summary":"The flat npm package, through version 6.0.1, lets an attacker supply keys like a.4294967294 to unflatten(), which creates a huge sparse array. Iterating that array with forEach, spread or JSON.stringify blocks the Node.js event loop, causing a denial of service.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"flat","fixed":[],"affected":"<= 6.0.1","ecosystem":"npm"}],"ecosystems":[],"tags":["backend","denial-of-service","flat","node","npm","package"],"not_affected_if":["flat-not-used","no-untrusted-input","object-option-enabled"],"how_to_check":"- `npm ls flat` : any version up to 6.0.1 (including the latest) is affected, and it is often a transitive dependency\n- Search for `unflatten(` imports from 'flat' fed by request bodies, query strings, or uploaded JSON/config. Keys like a.4294967294 are the trigger.","fix":"No patched release of flat as of 2026-10-29: npm latest is 6.0.1, the affected version. Until one ships: do not pass untrusted keys to unflatten(); reject keys with large numeric segments, or use the { object: true } option so arrays are not created.","status":"open","published_at":"2026-10-29T14:17:52+00:00","first_seen_at":"2026-10-29T14:25:23+00:00","triaged_at":"2026-10-29T14:25:56+00:00","updated_at":"2026-10-29T14:26:58+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-29T14:25:56Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"flat: unflatten() lets crafted keys stall Node.js event loop","impact":"low","summary":"The flat npm package, through version 6.0.1, lets an attacker supply keys like a.4294967294 to unflatten(), which creates a huge sparse array. Iterating that array with forEach, spread or JSON.stringify blocks the Node.js event loop, causing a denial of service.","audience":"developers","category":"package","nicknames":[],"who_cares":["node","npm","flat","backend"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker stalls the Node.js process with a single crafted request","analyst_note":"Confirm the fixed version and whether unflatten() input from requests is a common path; check https://nvd.nist.gov/vuln/detail/CVE-2026-119051 and the flat repository advisory.","how_to_check":"- `npm ls flat` to see whether flat is in the dependency tree and which version resolves\n- Search the code for calls to `unflatten(` from the flat package on input that comes from users or requests","plain_action":"","needs_analyst":true,"not_affected_if":["no-untrusted-input","flat-not-used"],"who_is_affected":"Applications that call unflatten() from flat 6.0.1 or earlier on untrusted input, such as request bodies or query strings, are exposed. Projects that only flatten trusted internal data, or that do not use flat, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000692,"input_tokens":4143,"output_tokens":555,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and whether unflatten() input from requests is a common path; check https://nvd.nist.gov/vuln/detail/CVE-2026-119051 and the flat repository advisory.","search":"'-119051':12A,15A '-2026':11A,14A '6.0.1':32B,68C 'a.4294967294':39B,96C 'alloc':73C 'allow':78C 'array':47B,50B,84C 'attack':35B,79C,89C 'backend':17B 'block':56B,105C 'caus':61B,97C 'contain':69C 'craft':4A 'creat':43B,81C 'cve':10A,13A 'denial':19B,63B 'denial-of-servic':18B 'event':8A,59B,108C 'flat':1A,16A,22B,27B,66C 'flatten':92C 'foreach':52B,100C 'huge':45B,82C 'iter':48B,98C 'json.stringify':55B,103C 'key':5A,37B,88C,93C 'let':3A,33B 'like':38B 'loop':9A,60B,109C 'node':23B 'node.js':7A,58B,107C 'npm':24B,28B 'numer':87C 'packag':25B,29B 'resourc':72C 'servic':21B,65B 'spars':46B,83C 'spread':53B,101C 'stall':6A 'suppli':36B,91C 'unbound':86C 'uncontrol':71C 'unflatten':2A,41B,76C 'version':31B 'via':85C 'vulner':74C","nicknames":[],"mitigations":[],"who_affected":"Applications that call unflatten() from flat 6.0.1 or earlier on untrusted input, such as request bodies or query strings, are exposed. Projects that only flatten trusted internal data, or that do not use flat, can skip it.","tier":"B","verified":{"who_affected":{"at":"2026-10-29T14:26:58Z","by":"analyst","doc":"https://registry.npmjs.org/flat/latest","run_id":1029}},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"first_public_at":"2026-10-29T14:17:52+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119051","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119051","severity":null,"published_at":"2026-10-29T14:17:52+00:00","modified_at":"2026-10-29T14:17:52+00:00","first_seen_at":"2026-10-29T14:25:23+00:00","fetched_at":"2026-10-29T14:25:23+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119051:1029","url":null,"severity":null,"published_at":"2026-10-29T14:26:58+00:00","modified_at":"2026-10-29T14:26:58+00:00","first_seen_at":"2026-10-29T14:26:58+00:00","fetched_at":"2026-10-29T14:26:58+00:00","note":"VulnCheck (CNA) advisory read; it cites GitHub issue #195 on hughsk/flat, which I could not fetch. npm registry shows 6.0.1 (2023) as latest, so no fix exists. Mitigation (object:true) is my inference from the README, not stated by the advisory. No PoC or exploitation found; I did not search social posts. Fix none is based on the registry, not a maintainer statement."}],"documents":[{"id":17053,"url":"https://www.vulncheck.com/advisories/flat-through-6.0.1-denial-of-service-via-unflatten-numeric-array-index-keys","title":"VulnCheck: flat through 6.0.1 DoS via unflatten() numeric array index keys","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":17054,"url":"https://registry.npmjs.org/flat/latest","title":"npm registry: flat latest is 6.0.1 (2023-09-19)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}