Medium severity · published Oct 29, 2026
CVE-2026-119051
flat through 6.0.1 Denial of Service via unflatten() Numeric Array Index Keys
New
5.9
CVSS
–
EPSS
No
On KEV
Description
flat through 6.0.1 contains an uncontrolled resource allocation vulnerability in unflatten() that allows attackers to create huge sparse arrays via unbounded numeric keys. Attackers can supply flattened keys such as a.4294967294, causing iteration with forEach, spread or JSON.stringify to block the Node.js event loop.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FL
flat · hughsk
through 6.0.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-119051
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-119051
issue-tracking
https://github.com/hughsk/flat/issues/195
product
https://github.com/hughsk/flat
technical-description
https://github.com/hughsk/flat/blob/1d68e1d06c0210cff31e5c61ac177f3e2d3fa564/index.js#L65-L75
technical-description
https://github.com/hughsk/flat/blob/1d68e1d06c0210cff31e5c61ac177f3e2d3fa564/index.js#L137-L142
third-party-advisory
https://www.vulncheck.com/advisories/flat-through-6.0.1-denial-of-service-via-unflatten-numeric-array-index-keys