CVE-2026-27601

Name of the Vulnerable Software and Affected Versions Underscore.js versions prior to 1.13.8

Description The .flatten and .isEqual functions use recursion without a depth limit, which can lead to a stack overflow and a Denial of Service (DoS). This occurs when untrusted input is used to create a recursive data structure (for example, via JSON.parse) without an enforced depth limit, and this structure is then passed to the affected functions. For .flatten, the issue is exploitable if the data structure consists of arrays at all levels and no finite depth limit is provided as the second argument. For .isEqual, the issue is exploitable if two distinct data structures submitted by the same remote client are compared. Stack overflow exceptions resulting from these calls are not caught, potentially causing the application to crash.

Recommendations Update Underscore.js to version 1.13.8 or later. Enforce a depth limit (e.g., 100 to 1000 levels) on data structures created from untrusted input. As a temporary workaround for .flatten, pass a second argument that limits the flattening depth to 1000 or less.