Most recent entries from all

certfr-2026-avi-0500 — De multiples vulnérabilités ont été découvertes dans VMware Tanzu. Elles permettent à un attaquant de provoquer un prob…

certfr-2026-avi-0500

CLEANSTART-2026-BE82466 — Security fix for CVE-2026-32141 applied in: argo-workflows 3.6.19-r7, argo-workflows 3.7.15-r3, renovate 43.4.3-r1, ren…

Affected: CleanStart: argo-workflows, CleanStart: renovate

CVE-2026-32141 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.

EUVD-2026-363713

fkie_cve-2026-32141

flatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process. This vulnerability is fixed in 3.4.0.

GHSA-25h7-pfq9-p65f — flatted vulnerable to unbounded recursion DoS in parse() revive phase

Affected: npm: flatted

## Summary

flatted's `parse()` function uses a recursive `revive()` phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential `$` indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process.

## Impact

Denial of Service (DoS). Any application that passes untrusted input to `flatted.parse()` can be crashed by an unauthenticated attacker with a single request.

flatted has ~87M weekly npm downloads and is used as the circular-JSON serialization layer in many caching and logging libraries.

## Proof of Concept

```javascript const flatted = require('flatted');

// Build deeply nested circular reference chain const depth = 20000; const arr = new Array(depth + 1); arr[0] = '{"a":"1"}'; for (let i = 1; i <= depth; i++) { arr[i] = `{"a":"${i + 1}"}`; } arr[depth] = '{"a":"leaf"}';

const payload = JSON.stringify(arr); flatted.parse(payload); // RangeError: Maximum call stack size exceeded ```

## Fix

The maintainer has already merged an iterative (non-recursive) implementation in PR #88, converting the recursive `revive()` to a stack-based loop.

## Affected Versions

All versions prior to the PR #88 fix.

msrc_CVE-2026-32141 — flatted: Unbounded recursion DoS in parse() revive phase

msrc_CVE-2026-32141

RHSA-2026:13826 — Red Hat Security Advisory: Red Hat Developer Hub 1.9.4 release.

axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization python-markdown: denial of service via malformed HTML-like sequences undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression undici: undici: Denial of Service via crafted WebSocket frame with large length undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter rhdh: GraphQL Injection Leading to Platform-Wide Denial of Service (DoS) in RH Developer Hub Orchestrator Plugin lodash: lodash: Arbitrary code execution via untrusted input in template imports path-to-regexp: path-to-regexp: Denial of Service via crafted regular expressions Underscore.js: Underscore.js: Denial of Service via recursive data structures in flatten and isEqual functions minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution svgo: SVGO: Denial of Service via XML entity expansion backstage/plugin-techdocs-node: TechDocs Mkdocs configuration key enables arbitrary code execution flatted: flatted: Unbounded recursion DoS in parse() revive phase crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building golang: internal/syscall/unix: Root.Chmod can follow symlinks out…

UBUNTU-CVE-2026-32141

Affected: Ubuntu:20.04:LTS: node-flatted, Ubuntu:22.04:LTS: node-flatted, Ubuntu:24.04:LTS: node-flatted, Ubuntu:25.10: node-flatted, Ubuntu:26.04:LTS: node-flatted

WID-SEC-W-2026-1220 — IBM App Connect Enterprise: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Dateien zu manipulieren, und um einen Denial of Service Angriff durchzuführen.