---
id: "CVE-2026-119051"
kind: "vulnerability"
aliases: ["CVE-2026-119051"]
title: "flat: unflatten() lets crafted keys stall Node.js event loop"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "flat", "fixed": [], "affected": "<= 6.0.1", "ecosystem": "npm"}]
ecosystems: []
tags: ["backend", "denial-of-service", "flat", "node", "npm", "package"]
not_affected_if: ["flat-not-used", "no-untrusted-input", "object-option-enabled"]
published_at: "2026-10-29T14:17:52+00:00"
first_seen_at: "2026-10-29T14:25:23+00:00"
updated_at: "2026-10-29T14:26:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119051", "first_seen_at": "2026-10-29T14:25:23+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-29T14:26:58+00:00"}]
---

# flat: unflatten() lets crafted keys stall Node.js event loop

The flat npm package, through version 6.0.1, lets an attacker supply keys like a.4294967294 to unflatten(), which creates a huge sparse array. Iterating that array with forEach, spread or JSON.stringify blocks the Node.js event loop, causing a denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:flat affected <= 6.0.1 fixed ?

## How to check

- `npm ls flat` : any version up to 6.0.1 (including the latest) is affected, and it is often a transitive dependency
- Search for `unflatten(` imports from 'flat' fed by request bodies, query strings, or uploaded JSON/config. Keys like a.4294967294 are the trigger.

## Fix

No patched release of flat as of 2026-10-29: npm latest is 6.0.1, the affected version. Until one ships: do not pass untrusted keys to unflatten(); reject keys with large numeric segments, or use the { object: true } option so arrays are not created.

## Timeline

- 2026-10-29T14:25:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119051
- 2026-10-29T14:26:58+00:00 analyst — VulnCheck (CNA) advisory read; it cites GitHub issue #195 on hughsk/flat, which I could not fetch. npm registry shows 6.0.1 (2023) as latest, so no fix exists. Mitigation (object:true) is my inference from the README, not stated by the advisory. No PoC or exploitation found; I did not search social posts. Fix none is based on the registry, not a maintainer statement.

## Documents

- [advisory] VulnCheck: flat through 6.0.1 DoS via unflatten() numeric array index keys https://www.vulncheck.com/advisories/flat-through-6.0.1-denial-of-service-via-unflatten-numeric-array-index-keys
- [fix] npm registry: flat latest is 6.0.1 (2023-09-19) https://registry.npmjs.org/flat/latest

## From the sources

flat through 6.0.1 contains an uncontrolled resource allocation vulnerability in unflatten() that allows attackers to create huge sparse arrays via unbounded numeric keys. Attackers can supply flattened keys such as a.4294967294, causing iteration with forEach, spread or JSON.stringify to block the Node.js event loop.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_