npm flat vulnerabilities

Latest npm flat CVEs

Newest publication first

1. CVE-2026-119051 flat through 6.0.1 Denial of Service via unflatten() Numeric Array Index Keys

   Published 2026-10-29

   High·CVSS 8.2 EPSS 0.32%

   flat through 6.0.1 contains an uncontrolled resource allocation vulnerability in unflatten() that allows attackers to create huge sparse arrays via unbounded numeric keys. Attackers can supply flattened keys such as a.4294967294, causing iteration with forEach, spread or JSON.str...

2. CVE-2020-36632 hughsk flat index.js unflatten prototype pollution

   Published 2022-12-25

   Critical·CVSS 9.8 EPSS 1.2%

   A vulnerability, which was classified as critical, was found in hughsk flat up to 5.0.0. This affects the function unflatten of the file index.js. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). It is possible t...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.