CVE-2026-119051
Medium · 5.9CVSS
5.9
EPSS
0.3%
Published
Oct 29, 2026
CISA due date
—
The record
flat through 6.0.1 contains an uncontrolled resource allocation vulnerability in unflatten() that allows attackers to create huge sparse arrays via unbounded numeric keys. Attackers can supply flattened keys such as a.4294967294, causing iteration with forEach, spread or JSON.stringify to block the Node.js event loop.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-119699 WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption… CWE-770
- CVE-2026-119701 WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allows… CWE-770
- CVE-2026-119036 Business::GoCardless versions before 1.01 for Perl allow memory exhaustion by flattening… CWE-770
- CVE-2026-116128 Starlet versions from 0.20 before 0.33 for Perl allow memory exhaustion via unbounded… CWE-770
- CVE-2026-107312 Allocation of Resources Without Limits or Throttling vulnerability in Drupal Examples for… CWE-770
- CVE-2026-119209 pypdf is a free and open-source pure-python PDF library. CWE-770
- CVE-2026-90991 IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to… CWE-770
- CVE-2026-119134 Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 caps… CWE-770