CVE-2026-27601: 
JavaScript vulnerability analysis and mitigation

CVE-2026-27601 is a Denial of Service (DoS) vulnerability in Underscore.js caused by unlimited recursion in the _.flatten and _.isEqual functions. Discovered and disclosed on March 3, 2026, it affects all versions of Underscore.js up to and including 1.13.7 (Node.js). The vulnerability carries a CVSS v3.1 base score of 5.9 (Medium) and a CVSS v4.0 base score of 8.2 (High) (GitHub Advisory). Multiple IBM products that bundle Underscore.js are also affected, including IBM API Connect, IBM Instana, IBM watsonx Orchestrate, IBM App Connect Enterprise, and others (GitHub Advisory).

The root cause is uncontrolled recursion (CWE-674) and allocation of resources without limits or throttling (CWE-770): both _.flatten and _.isEqual implemented recursive traversal with no depth limit, allowing deeply nested data structures to exhaust the JavaScript call stack. An attacker can craft a deeply nested JSON structure (~4500 levels) via JSON.parse from untrusted input and pass it to either function, triggering a RangeError: Maximum call stack size exceeded that is not caught by the application. For _.flatten, exploitation requires the structure to consist entirely of arrays and no finite depth argument to be passed; for _.isEqual, a code path must exist where two attacker-controlled structures are compared. The fix in version 1.13.8 rewrites both functions to use an iterative stack-based approach instead of recursion (GitHub Advisory, Flatten Patch, isEqual Patch).

Successful exploitation causes an unhandled stack overflow exception that crashes the Node.js process, resulting in a complete loss of availability for the affected service. There is no impact on confidentiality or integrity — the vulnerability is purely a DoS condition. Server applications that rely on continuous uptime are most at risk, as a crash requires a manual or automated restart to restore service (GitHub Advisory).

A proof-of-concept (PoC) is publicly available in the GitHub Security Advisory, demonstrating exploitation of both _.flatten and _.isEqual with ~4500-level nested structures. There is no evidence of active in-the-wild exploitation as of the time of disclosure. The EPSS score is approximately 0.04% (0.022% per GitHub Advisory, 6th percentile), indicating low near-term exploitation probability. The vulnerability is not listed in the CISA KEV catalog, and no threat actor attribution has been reported (GitHub Advisory).

1. Reconnaissance: Identify applications using Underscore.js ≤1.13.7 (Node.js) that accept untrusted JSON input and pass parsed structures to _.flatten or _.isEqual. Check package.json or npm list underscore for the installed version.
2. Craft malicious payload: Construct a deeply nested JSON object or array (~4500 levels) designed to exhaust the call stack. For _.isEqual: build a JSON string with 4500 nested {"n": wrappers. For _.flatten: build a 4500-level nested array [[[...]]].
3. Submit payload: Send the crafted JSON as untrusted input to the target application endpoint (e.g., via HTTP POST body) where it will be parsed with JSON.parse without a depth limit.
4. Trigger vulnerable function: Ensure the application code path passes the parsed structure to _.flatten (without a depth argument) or _.isEqual (comparing two attacker-controlled structures). This may require submitting data that is stored and later compared, or exploiting a path where input is parsed twice.
5. Achieve DoS: The recursive function call exhausts the JavaScript call stack, throwing an uncaught RangeError: Maximum call stack size exceeded, crashing the Node.js process and causing service unavailability (GitHub Advisory).

• Logs: Node.js process logs or application error logs showing RangeError: Maximum call stack size exceeded originating from _.flatten or _.isEqual call sites in Underscore.js.
• Logs: Repeated or unusual HTTP requests with deeply nested JSON payloads (large request bodies with many levels of nesting) in web server access logs.
• Process: Sudden unexpected termination or restart of the Node.js application process, particularly correlated with incoming HTTP requests containing large JSON bodies.
• Network: HTTP requests with abnormally large JSON payloads (potentially hundreds of kilobytes) targeting API endpoints that process user-supplied structured data.

Upgrade Underscore.js to version 1.13.8 or later, which rewrites _.flatten and _.isEqual to use iterative (non-recursive) implementations, fully preventing exploitation (GitHub Advisory). As interim workarounds before patching: (1) enforce a depth limit (≤1000 levels, or ≤100 on constrained hardware) on all data structures created from untrusted input before passing them to these functions; (2) always pass a finite depth argument as the second parameter to _.flatten; (3) avoid comparing attacker-controlled data structures with _.isEqual. IBM has released product-specific advisories for affected products including QRadar AQL Plugin, API Connect, Instana, watsonx Orchestrate, App Connect Enterprise, and Cloud Pak for Business Automation (IBM QRadar Advisory).

IBM issued multiple security bulletins addressing this CVE across a broad range of products, including QRadar, API Connect, Instana, watsonx Orchestrate, App Connect Enterprise, Decision Optimization for Cloud Pak for Data, and Business Automation Insights, reflecting the wide adoption of Underscore.js in enterprise software (IBM QRadar Advisory). Red Hat also published errata addressing this vulnerability. The vulnerability was detected by Qualys (detection ID 151081) and coverage appeared across standard vulnerability tracking platforms shortly after disclosure.