CVE-2026-119051highCWE-770

CVE-2026-119051: high-severity vulnerability in hughsk flat

flat through 6.0.1 Denial of Service via unflatten() Numeric Array Index Keys

Published · Updated

Follow this CVE+ Monitor flat

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.2epss 0.3%
flat through 6.0.1 contains an uncontrolled resource allocation vulnerability in unflatten() that allows attackers to create huge sparse arrays via unbounded numeric keys. Attackers can supply flattened keys such as a.4294967294, causing iteration with forEach, spread or JSON.stringify to block the Node.js event loop.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
hughsk · flat
Related CVEs — hughsk flat

In the same product, most dangerous first.

CVE-2020-36632MEDIUMhughsk flat index.js unflatten prototype pollutionEPSS 1.2%