CVE-2026-27601

What it actually does

Underscore.js versions prior to 1.13.8 can recurse without a depth limit in _.flatten and _.isEqual. If an application accepts attacker-controlled nested data structures and passes them into these functions under the required conditions, the recursive calls can exhaust the JavaScript call stack and raise an uncaught stack overflow exception. In server-side JavaScript applications, this can terminate the request handler, worker, or process depending on runtime and error handling, causing denial of service. The issue does not provide code execution, data disclosure, or data modification by itself; the primary impact is availability loss.

Why it matters to the business

Applications that use vulnerable Underscore.js versions may be taken offline or made unreliable by specially crafted deeply nested input. Because Underscore is a widely used JavaScript utility dependency, exposure may exist indirectly through transitive packages as well as direct imports. The vulnerability has a moderate CVSS score and low EPSS probability, but public exploit information is available, so internet-facing APIs that process untrusted JSON or similar structured input should be prioritized for review and upgrade.

How an attack unfolds

An attacker identifies an endpoint or workflow that accepts user-controlled structured input, such as JSON arrays or objects, without enforcing a maximum nesting depth. The attacker submits data crafted to create an extremely deep recursive structure. For _.flatten exploitation, the data must consist of arrays at each level and the application must call _.flatten without a finite depth limit. For _.isEqual exploitation, the attacker must cause two separate but equivalent deeply nested structures under their control to be compared, such as by submitting one structure for storage and later submitting another for comparison, or by triggering code that parses the same payload twice and compares the resulting objects. When vulnerable Underscore.js code recursively traverses the structures, the JavaScript call stack is exhausted. If the resulting exception is not caught, the process, worker, or request path can fail, producing a denial-of-service condition.

How to fix it

Upgrade Underscore.js to version 1.13.8 or later wherever it is used directly or transitively. Regenerate dependency lockfiles and rebuild/redeploy affected applications so the fixed package is actually loaded at runtime. If immediate upgrade is not possible, enforce strict maximum depth and size limits on untrusted JSON or other structured input before it reaches application logic; reject excessively nested arrays and objects; pass a finite depth argument when using _.flatten; avoid comparing attacker-controlled deeply nested structures with _.isEqual; and ensure stack overflow or RangeError exceptions are caught so a single malformed request cannot terminate a service process. Apply rate limiting and request body size limits as defense-in-depth for exposed APIs.

How to confirm the fix worked

Confirm that all dependency manifests, lockfiles, software composition analysis results, and runtime deployments show Underscore.js version 1.13.8 or later. Search for direct imports or bundled copies of Underscore, including vendored browser bundles and transitive dependency trees. Review code paths that call _.flatten or _.isEqual on request-derived, message-derived, or otherwise untrusted data. Test representative endpoints with safe, controlled deeply nested payloads in a non-production environment to verify that requests are rejected by validation controls or handled without process termination. Confirm application logs no longer show uncaught stack overflow exceptions from underscore functions after remediation.

Typical attack path

1. Discover an application endpoint that accepts attacker-controlled JSON or similar structured input.
2. Send test payloads with increasing nesting depth to determine whether deep structures are accepted.
3. Identify behavior indicating use of Underscore.js recursion, such as stack overflow errors, request crashes, or service restarts when nested arrays or objects are submitted.
4. For _.flatten paths, submit a deeply nested all-array payload where the application calls _.flatten without a finite depth argument.
5. For _.isEqual paths, cause two attacker-controlled deeply nested structures to be compared through a stored-then-compared workflow or repeated parsing/comparison behavior.
6. Trigger call stack exhaustion, resulting in uncaught RangeError or stack overflow exceptions and service degradation or outage.

How to detect it

To assess possible prior exploitation, review application logs, API gateway logs, web server logs, process supervisor logs, container orchestration events, and APM/error-monitoring telemetry for stack overflow exceptions correlated with requests containing very deeply nested arrays or objects. Look for repeated HTTP 500 responses, worker exits, container restarts, Node.js process crashes, memory/CPU spikes, or sudden availability drops following unusually large or deeply nested JSON submissions. In JavaScript error traces, focus on RangeError or stack overflow messages with stack frames referencing underscore, flatten, isEqual, baseFlatten, or eq. For API logs that retain request metadata or payload samples, search for suspiciously repeated bracket patterns, extreme nesting, oversized JSON bodies, or requests that precede crashes. Exploitation is application-path dependent, so absence of a generic network signature does not rule out abuse; correlate crash telemetry with source IPs, user agents, request paths, and payload characteristics.

• RangeError: Maximum call stack size exceeded
• InternalError: too much recursion
• Maximum call stack size exceeded
• too much recursion
• underscore.js
• underscore-min.js
• node_modules/underscore/underscore.js
• node_modules/underscore/modules/flatten.js
• node_modules/underscore/modules/isEqual.js
• _.flatten
• _.isEqual
• baseFlatten
• isEqual
• eq(a, b, aStack, bStack)
• "underscore":"<1.13.8"
• "underscore": "<1.13.8"
• underscore@1.13.7
• underscore@1.13.6
• underscore@1.13.5

What your security team should do

• Inventory all applications and packages that include Underscore.js, including transitive dependencies and bundled frontend assets.
• Prioritize internet-facing services, APIs, webhook handlers, message consumers, and file import pipelines that parse untrusted structured data.
• Upgrade Underscore.js to 1.13.8 or later and redeploy affected services.
• Add maximum nesting-depth, request-size, and payload-complexity validation for JSON and equivalent structured formats.
• Review use of _.flatten and _.isEqual; require finite flatten depth and avoid equality comparison of attacker-controlled deeply nested structures.
• Add or verify global exception handling so RangeError or stack overflow conditions do not crash long-running service processes.
• Monitor for repeated stack overflow errors, process restarts, elevated 5xx rates, and suspicious deeply nested request bodies.
• Because public exploit information is available, treat exposed vulnerable parsing paths as higher priority even though the current EPSS score is low and the issue is not listed in CISA KEV.