CVE-2026-32141

Highest-risk unexploited with PoCs

Exploit code exists, no confirmed in-the-wild activity, ranked by EPSS

Actively Exploited

Confirmed exploited in the wild, sorted by most recently updated

CVSS 7.5EPSS 1%

Published 2026-03-12Updated 2026-03-12

Vulnerability details

flatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process. This vulnerability is fixed in 3.4.0.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CNAGitHub_M

EPSS score history

Sources

3 links

PoC links are not available for guest users. Login to view them.

CVE Organization RedHat Vuln DB NVD Analysis

Profile

CVSS

7.5

EPSS

Published

2026-03-12

Updated

2026-03-12

CNA

GitHub_M

Vendors

WebReflection

1 product

CPEs

cpe:/a:redhat:rhdh:1.8::el9

cpe:/a:redhat:rhdh:1.9::el9

cpe:/a:redhat:openshift_ai:2.16::el8

cpe:/a:redhat:openshift_devspaces:3.28::el9

cpe:/a:redhat:logging:5

cpe:/a:redhat:red_hat_3scale_amp:2

cpe:/a:redhat:ansible_automation_platform:2

cpe:/a:redhat:service_registry:2

cpe:/a:redhat:jboss_data_grid:8

cpe:/a:redhat:edge_manager:1

cpe:/a:redhat:jboss_fuse:7

cpe:/a:redhat:red_hat_single_sign_on:7

cpe:/a:redhat:amq_streams:2

cpe:/a:redhat:amq_streams:3

cpe:/a:redhat:cryostat:4

cpe:/a:redhat:amq_broker:7

cpe:/a:redhat:optaplanner:::el6

cpe:/a:redhat:directory_server:11

cpe:/a:redhat:directory_server:12

cpe:/a:redhat:directory_server:13

cpe:/o:redhat:enterprise_linux:8

cpe:/o:redhat:enterprise_linux:9

cpe:/a:redhat:jboss_enterprise_application_platform:7

cpe:/a:redhat:jboss_enterprise_application_platform:8

cpe:/a:redhat:jbosseapxp

cpe:/a:redhat:openshift_ai

cpe:/a:redhat:openshift:4

cpe:/a:redhat:jboss_enterprise_bpms_platform:7

cpe:/a:redhat:quay:3

cpe:/a:redhat:cluster_observability_operator:1.5::el9

cpe:/a:redhat:edge_manager:1.0::el9

cpe:/a:redhat:edge_manager:1.1::el9

cpe:/a:redhat:edge_manager:1.1::el10

Vulnerability dashboard

Highest-risk unexploited with PoCs

Actively Exploited

Recently Updated