Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
flatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process. This vulnerability is fixed in 3.4.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-32141 Recursive Stack Overflow Vulnerability in Flatted JSON Parser Before 3.4.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-32141
Post summary
The post announces CVE-2026-32141, a recursive stack overflow issue in the Flatted JSON Parser before version 3.4.0, without providing a PoC, exploit, or patch information.
CVE-2026-32141 flatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. Whe… https://www.cve.org/CVERecord?id=CVE-2026-32141
Post summary
The post announces CVE-2026-32141 as a flaw in flatted's JSON parsing logic before version 3.4.0, detailing its circular reference handling but providing no proof‑of‑concept, exploit, or remediation guidance.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | webreflection | flatted | - | node.js | - |