CVE-2026-27601
1 advisory.
npm/underscore CVE-2026-27601: medium 5.9
Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack
Action: Upgrade underscore to 1.13.8 or later.
npm i underscore@1.13.8Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.13.8 | - |
Fixed versions
| 1.13.8 |
Sources
- osv: GHSA-qpx9-hpmf-5gmw
- https://github.com/jashkenas/underscore/security/advisories/GHSA-qpx9-hpmf-5gmw
- https://nvd.nist.gov/vuln/detail/CVE-2026-27601
- https://github.com/jashkenas/underscore/issues/3011
- https://github.com/jashkenas/underscore/commit/411e222eb0ca5d570cc4f6315c02c05b830ed2b4
- https://github.com/jashkenas/underscore/commit/a6e23ae9647461ec33ad9f92a2ecfc220eea0a84
- https://github.com/jashkenas/underscore
- https://underscorejs.org/#1.13.8
- https://underscorejs.org/#flatten
- https://underscorejs.org/#isEqual
CVE-2026-27601 · published · modified · JSON