CVE-2026-33228 is a vulnerability in the Flatted circular JSON parser, which allows an attacker to pollute the global prototype by providing unvalidated string values as direct array index keys. This issue was patched in version 3.4.2. The vulnerability has a CVSS score of 8.9 and is considered HIGH severity. The CVE was published on March 20, 2026, and last modified on June 27, 2026. The vulnerability af [truncated]
CVE-2026-32141 is a vulnerability in the Flatted circular JSON parser, which can lead to a stack overflow and crash the Node.js process. The vulnerability is caused by an unbounded recursion depth in the parse() function's revive() phase when given a crafted payload with deeply nested or self-referential $ indices. This issue was fixed in version 3.4.0. Users of Flatted prior to 3.4.0 are advised to upgra [truncated]
