flatted vulnerabilities

2 known vulnerabilities in flatted from WebReflection. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  flatted: Improperly Controlled Modification of Object Prototype Attributes

  CVE-2026-33228Mar 20, 2026WebReflection

  flatted is a circular JSON parser. Prior to version 3.4.2, the parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index keys, without validating that they are numeric. Since the internal input buffer is a

• 7.5 High severity

  flatted: Uncontrolled Recursion

  CVE-2026-32141Mar 12, 2026WebReflection

  flatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion dept