CVE-2026-119051 in flat
Summary
by MITRE • 10/29/2026
flat through 6.0.1 contains an uncontrolled resource allocation vulnerability in unflatten() that allows attackers to create huge sparse arrays via unbounded numeric keys. Attackers can supply flattened keys such as a.4294967294, causing iteration with forEach, spread or JSON.stringify to block the Node.js event loop.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified in flat versions through 6.0.1 represents a critical uncontrolled resource allocation flaw located within the core array flattening logic of the library. This issue specifically affects the internal implementation of the unflatten function, which is designed to reconstruct nested object structures from flattened key-value pairs. The root cause lies in how the parser handles numeric keys during the reconstruction process. When an attacker supplies a flattened key containing an extremely large integer value, such as 4294967294, the library attempts to allocate memory for an array with that specific index. In JavaScript engines like V8 used by Node.js, arrays are optimized data structures where accessing or creating elements at very high indices forces the engine to pre-allocate a contiguous block of memory large enough to accommodate all intermediate empty slots. This behavior is intended to optimize access patterns but becomes a severe liability when input validation is absent.
The operational impact of this vulnerability is significant, primarily manifesting as a denial-of-service condition against Node.js applications that utilize flat for processing user-supplied data or configuration files. Because the allocation request targets an array index in the billions, it consumes excessive amounts of heap memory and CPU cycles during iteration operations such as forEach, spread syntax expansion, or serialization via JSON.stringify. These operations trigger internal loops within the JavaScript engine to initialize or traverse the massive sparse array structure. Consequently, this activity blocks the Node.js event loop, preventing the application from handling other incoming requests or executing asynchronous tasks. The result is a complete hang of the server process until memory limits are reached and the process crashes, effectively rendering the service unavailable to legitimate users.
From a classification perspective, this vulnerability aligns with CWE-400, which describes uncontrolled resource consumption. It also relates closely to CWE-789, as it involves improper control of resources based on external input without adequate bounds checking or validation limits. In terms of attack vectors and tactics, this flaw can be leveraged within the MITRE ATT&CK framework under T1496, Resource Hijacking, where an attacker consumes computational resources to degrade service availability. It may also fall under T1053, Scheduled Task/Job, if used in conjunction with other techniques to maintain persistence through resource exhaustion, though its primary utility here is as a direct denial-of-service vector against web services and API endpoints that parse flattened JSON or similar structures.
Mitigation strategies for this vulnerability focus on input validation and version management. The most effective immediate action is to upgrade the flat library to a patched version where 6.0.2 or later, which includes safeguards to limit the maximum array index size during unflattening operations. For applications unable to update immediately due to dependency constraints, developers should implement strict input sanitization before passing data to the unflatten function. This involves validating that all numeric keys in flattened objects fall within a reasonable range expected by the application logic, typically ensuring they do not exceed standard array length limits or predefined thresholds such as 10^6. Additionally, implementing rate limiting and request size restrictions at the network edge can help mitigate the impact of malicious payloads attempting to trigger this resource exhaustion before it reaches the vulnerable library code.