Executive brief
flatted is a widely-used JavaScript library (~87M weekly npm downloads) that serializes and deserializes JSON with circular references. The library's parse() function contains an unbounded recursion vulnerability that allows an attacker to crash any application using it by sending a specially crafted payload with deeply nested circular references, causing a stack overflow and immediate denial of service with a single request.
Technical details
The vulnerability exists in flatted's parse() function, specifically in the revive() phase which recursively resolves circular references in deserialized JSON. The revive() function uses unbounded recursion when processing deeply nested or self-referential $ indices in crafted payloads, resulting in a RangeError when the call stack exceeds Node.js limits. An unauthenticated attacker on the network can exploit this by sending a single malicious JSON payload to any application that passes untrusted input to flatted.parse(), causing immediate process termination. The vulnerability is a classic Uncontrolled Recursion issue (CWE-674). A fix has already been merged in PR #88 which converts the recursive revive() implementation to an iterative stack-based approach, eliminating the unbounded recursion risk.
Affected products
- WebReflection flatted <= 3.3.3
Timeline
- 2026-03-13: disclosed
- 2026-03-08: patched: Fix merged in PR #88 converting recursive revive() to iterative stack-based implementation