redhat/nodejs-webpack-cli vulnerabilities

Latest redhat/nodejs-webpack-cli CVEs

Newest publication first

1. CVE-2026-119051 flat through 6.0.1 Denial of Service via unflatten() Numeric Array Index Keys

   Published 2026-10-29

   High·CVSS 8.2

   flat through 6.0.1 contains an uncontrolled resource allocation vulnerability in unflatten() that allows attackers to create huge sparse arrays via unbounded numeric keys. Attackers can supply flattened keys such as a.4294967294, causing iteration with forEach, spread or JSON.str...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.