CVE-2026-119051

Name of the Vulnerable Software and Affected Versions flat versions prior to 6.0.2

Description An uncontrolled resource allocation issue exists in the unflatten() function. Attackers can provide flattened keys containing unbounded numeric values, such as a.4294967294, to create massive sparse arrays. This can lead to the Node.js event loop being blocked during operations like forEach, spread, or JSON.stringify.

Recommendations Update flat to version 6.0.2 or later. As a temporary mitigation, restrict the use of the unflatten() function when processing untrusted input.