REDHAT-BUG-2447083: High severity npm/flatted vulnerability
flatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process. This vulnerability is fixed in 3.4.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
flattedto a version that resolves this vulnerability.Fixed in 3.4.0
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2447083?
The severity of REDHAT-BUG-2447083 is classified as high (7).
How do I fix REDHAT-BUG-2447083?
To fix REDHAT-BUG-2447083, update the 'flatted' package to version 3.4.0 or later.
What risks are associated with REDHAT-BUG-2447083?
REDHAT-BUG-2447083 poses a risk of stack overflow due to unbounded recursion when parsing crafted payloads.
What software is affected by REDHAT-BUG-2447083?
The affected software for REDHAT-BUG-2447083 is npm/flatted.
When was REDHAT-BUG-2447083 published?
REDHAT-BUG-2447083 was published on March 12, 2026.