CVE-2026-119051— flat through 6.0.1 Denial of Service via unflatten() Numeric Array Index Keys

Quick assessment

Affected

hughsk flat

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

flat 库（6.0.1 及更早版本）在 unflatten() 函数中存在不受控的资源分配漏洞。攻击者可通过无界数值键创建巨大的稀疏数组。攻击者可提供如这类扁平化键，导致在调用 forEach、展开运算符（spread）或 JSON.stringify 时阻塞 Node.js 事件循环。

CVSS 5.9 · Medium Updated Oct 29, 2026

Possible ATT&CK Techniques 1 AI

T1499.003 · Application Exhaustion Flood

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

flat through 6.0.1 Denial of Service via unflatten() Numeric Array Index Keys

Source: CVE Program / CVE List V5

Vulnerability Description

flat through 6.0.1 contains an uncontrolled resource allocation vulnerability in unflatten() that allows attackers to create huge sparse arrays via unbounded numeric keys. Attackers can supply flattened keys such as a.4294967294, causing iteration with forEach, spread or JSON.stringify to block the Node.js event loop.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

不加限制或调节的资源分配

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
hughsk	flat	0 ~ 6.0.1	-

II. Public POCs for CVE-2026-119051

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119051

请登录查看更多情报信息。

Other References for CVE-2026-119051 (5)

https://github.com/hughsk/flat/blob/1d68e1d06c0210cff31e5c61ac177f3e2d3fa564/index.js#L65-L75 technical-description
https://github.com/hughsk/flat/blob/1d68e1d06c0210cff31e5c61ac177f3e2d3fa564/index.js#L137-L142 technical-description
https://github.com/hughsk/flat product
https://github.com/hughsk/flat/issues/195 issue-tracking
https://www.vulncheck.com/advisories/flat-through-6.0.1-denial-of-service-via-unflatten-numeric-array-index-keys third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-119051

IV. Related Vulnerabilities

Same product: flat

CVE-2020-36632
hughsk flat index.js unflatten prototype pollution

Same vendor: hughsk

CVE-2020-36632
hughsk flat index.js unflatten prototype pollution

Same weakness: CWE-770