CVE-2026-32141: 
JavaScript vulnerability analysis and mitigation

CVE-2026-32141 is an unbounded recursion denial-of-service vulnerability in the flatted npm package, a circular JSON parser with approximately 87 million weekly downloads. The flaw exists in the parse() function's recursive revive() phase, which resolves circular references without any depth limit. All versions of flatted prior to 3.4.0 (≤ 3.3.3) are affected. The vulnerability was disclosed on March 12, 2026, with a fix merged on March 8, 2026 via PR #88. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-674 (Uncontrolled Recursion) and CWE-770 (Allocation of Resources Without Limits or Throttling). The revive() function in flatted's parse() implementation recursively resolves $-indexed circular references in deserialized JSON without imposing any recursion depth limit. An attacker can craft a JSON payload containing deeply nested or self-referential $ indices — for example, an array of 20,000 nested objects — that causes the Node.js call stack to overflow with a RangeError: Maximum call stack size exceeded, crashing the process. No authentication or special privileges are required; any network-accessible endpoint that passes untrusted input to flatted.parse() is exploitable. The fix converts the recursive revive() to an iterative, stack-based loop (GitHub Security Advisory, Fix PR #88).

Successful exploitation results in a complete crash of the Node.js process, causing a denial of service for any application relying on flatted.parse() for JSON deserialization. There is no confidentiality or integrity impact — the vulnerability is purely an availability issue. Given flatted's widespread use as the circular-JSON serialization layer in many caching and logging libraries, the blast radius extends to any downstream application or service that transitively depends on it, including numerous IBM enterprise products such as IBM API Connect, Maximo Application Suite, QRadar Suite, and others (GitHub Advisory, IBM Advisory).

A public proof-of-concept (PoC) exploit is available in the GitHub Security Advisory, demonstrating a single-request crash of the Node.js process using a crafted 20,000-element nested array payload (GitHub Security Advisory). There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.038% (low probability of near-term exploitation). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Identify target: Locate a network-accessible Node.js application that accepts user-supplied JSON input and processes it with flatted.parse() — common in caching middleware, logging services, or APIs using libraries that depend on flatted.
2. Craft malicious payload: Build a deeply nested circular reference chain as a JSON array. For example, construct an array of 20,000+ elements where each element references the next via a $-indexed key:

const depth = 20000;
const arr = new Array(depth + 1);
arr[0] = '{"a":"1"}';
for (let i = 1; i <= depth; i++) {
  arr[i] = `{"a":"${i + 1}"}`;
}
arr[depth] = '{"a":"leaf"}';
const payload = JSON.stringify(arr);

3. Deliver payload: Send the crafted JSON payload to the target endpoint via a single HTTP request (e.g., POST body, query parameter, or any input channel that reaches flatted.parse()).
4. Trigger crash: The revive() function recursively processes the nested references without depth limits, exhausting the Node.js call stack and throwing RangeError: Maximum call stack size exceeded, crashing the process and causing denial of service (GitHub Security Advisory).

• Logs: Node.js process logs showing RangeError: Maximum call stack size exceeded originating from flatted parse/revive stack frames; application crash logs or unhandled exception reports coinciding with inbound JSON requests.
• Network: Inbound HTTP requests containing unusually large or deeply structured JSON payloads (e.g., arrays with thousands of elements) to endpoints that perform JSON deserialization; repeated requests from the same source IP triggering process restarts.
• Process: Unexpected Node.js process terminations or restarts (e.g., via process manager logs from PM2, systemd, or Kubernetes pod restart counts); elevated CPU usage immediately before crash due to deep recursion.
• Application: Service unavailability or 502/503 errors from upstream proxies immediately following receipt of a large JSON payload.

The primary remediation is to upgrade flatted to version 3.4.0 or later, which replaces the recursive revive() implementation with an iterative, stack-based loop (Fix PR #88, Fix Commit). As a short-term workaround, implement input validation and enforce size or depth limits on JSON payloads before passing them to flatted.parse(). IBM has released product-specific security updates for affected products including API Connect, Maximo Application Suite, QRadar Suite, App Connect Enterprise, and others — consult the relevant IBM support pages for version-specific guidance (IBM Cloud Pak Advisory). Red Hat has also issued errata (RHSA-2026:9742 and RHSA-2026:13826) for affected packages (Red Hat CVE).

The maintainer (WebReflection) proactively merged the fix (PR #88) on March 8, 2026 — before the CVE was publicly disclosed on March 12, 2026 — and noted that performance impact of the iterative approach was negligible (Fix PR #88). The vulnerability attracted broad attention in the open-source community given flatted's ~87M weekly npm downloads, with numerous downstream projects (including Mozilla pdf.js, Sentry JavaScript SDK, and Salesforce SLDS Linter) quickly issuing dependency update PRs. IBM issued over a dozen product security bulletins across its enterprise portfolio in the weeks following disclosure (IBM Cloud Pak Advisory). Splunk also issued an advisory (SVD-2026-0512) and Dell issued DSA-2026-091 referencing this CVE.