The vulnerability of the `_flatten` and `_isEqual` functions in the JavaScript library for working with arrays, Underscore, allows attackers to cause a service failure.

🗓️ 11 Aug 2026 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 2 Views

Underscore _flatten/_isEqual unlimited memory allocation enables remote DoS.

Reporter	Title	Published	Views	Family All 83
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to multiple node modules.	21 Apr 202618:47	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security SOAR is using a component with a known vulnerability (CVE-2026-27601)	22 Apr 202614:31	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of Underscore.js, IBM DevOps Solution Workbench is affected by a Denial of Service (CVE-2026-27601)	16 Mar 202608:36	–	ibm
IBM Security Bulletins	Security Bulletin: MongoDB Enterprised Advanced affected by: Allocation of Resources Without Limits or Throttling (CVE-2026-27601)	16 Jun 202617:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in underscore-1.13.7.tgz	6 May 202603:55	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Event Processing	22 Jul 202606:55	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities in IBM Business Automation Manager Open Editions	31 Mar 202612:18	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Bob	26 May 202614:04	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities affect IBM Voice Gateway	31 Mar 202615:54	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Underscore.js affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	22 Jun 202613:16	–	ibm

Vulners

Node

OR

red_hat red_hat_developer_hubMatch1.9

red_hat red_hat_developer_hubMatch1.10

jeremy_ashkenas underscoreRange<1.13.8

red_hat red_hat_developer_hubMatch1.8

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-27601
security-tracker	www.security-tracker.debian.org/tracker/CVE-2026-27601
github	www.github.com/jashkenas/underscore/commit/411e222eb0ca5d570cc4f6315c02c05b830ed2b4
github	www.github.com/jashkenas/underscore/commit/a6e23ae9647461ec33ad9f92a2ecfc220eea0a84
github	www.github.com/jashkenas/underscore/security/advisories/GHSA-qpx9-hpmf-5gmw
wiki	www.wiki.astralinux.ru/astra-linux-se38-bulletin-2026-0729SE38
web	www.web.nvd.nist.gov/view/vuln/detail

11 Aug 2026 00:00Current

5.9Medium risk

Vulners AI Score5.9

CVSS 37.5

CVSS 27.8

EPSS0.00893

Underscore DoS memory allocation _flatten _isEqual JavaScript remote attacker