Uncontrolled Resource Allocation in flat Product by Hughsk

CVE-2026-119051

What is CVE-2026-119051?

The flat library, specifically versions up to 6.0.1, has a vulnerability in the unflatten() function that allows attackers to exploit unbounded numeric keys. By supplying oversized keys such as a.4294967294, an attacker can generate vast sparse arrays, leading to issues like Denial of Service. This exploitation can effectively block the Node.js event loop during operations such as forEach, spread, or JSON.stringify, harming application performance and usability.

References