CVE-2026-119051: flat through 6.0.1 Denial of Service via unflatten() Numeric Array Index Keys
flat through 6.0.1 contains an uncontrolled resource allocation vulnerability in unflatten() that allows attackers to create huge sparse arrays via unbounded numeric keys. Attackers can supply flattened keys such as a.4294967294, causing iteration with forEach, spread or JSON.stringify to block the Node.js event loop.
Event History
Frequently Asked Questions
Who is exposed to this denial-of-service condition?
Applications using flat through 6.0.1 are exposed when they pass attacker-controlled flattened keys to unflatten() and subsequently process the resulting array with forEach, spread syntax, or JSON.stringify. The issue can block the Node.js event loop, affecting availability.
What does an attacker need to exploit it?
An attacker needs to be able to supply a flattened key containing a very large numeric array index, such as a.4294967294, to code that invokes unflatten(). No privileges or user interaction are required according to the provided vector.
Are all uses of the package affected by default?
The issue is specifically in unflatten() handling unbounded numeric keys. Deployments that do not call unflatten() on attacker-controlled input are not described as exploitable by the available information.
What can be done before a fix is available?
Do not pass untrusted flattened objects directly to unflatten(). Validate or reject numeric key segments that exceed an application-defined safe array-index limit before calling the function, and avoid processing untrusted results with forEach, spread, or JSON.stringify.