{"action":"Upgrade flatted to 3.4.0 or later.","affected":[{"fixed":"3.4.0","introduced":"0"}],"component":"flatted","cve_ids":["CVE-2026-32141"],"ecosystem":"npm","epss":0.00839,"exploited":false,"fixed_versions":["3.4.0"],"ghsa_id":"GHSA-25h7-pfq9-p65f","id":"tcs_01M5KES1DHV0NQ50RGV6ENYB38","modified_at":"2026-09-10T03:50:36.276174418Z","published_at":"2026-03-13T15:40:42Z","references":["https://osv.dev/vulnerability/GHSA-25h7-pfq9-p65f","https://github.com/WebReflection/flatted/security/advisories/GHSA-25h7-pfq9-p65f","https://nvd.nist.gov/vuln/detail/CVE-2026-32141","https://github.com/WebReflection/flatted/pull/88","https://github.com/WebReflection/flatted/commit/7eb65d857e1a40de11c47461cdbc8541449f0606","https://github.com/WebReflection/flatted"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-25h7-pfq9-p65f","url":"https://osv.dev/vulnerability/GHSA-25h7-pfq9-p65f"}],"summary":"flatted vulnerable to unbounded recursion DoS in parse() revive phase"}