Uncontrolled Recursion

Overview underscore is a JavaScript's functional programming helper library. Affected versions of this package are vulnerable to Uncontrolled Recursion through the .flatten or .isEqual functions that are used without a depth limit. An attacker can cause the application to crash or become...

Uncontrolled Recursion

Overview org.webjars.npm:underscore is a JavaScript's functional programming helper library. Affected versions of this package are vulnerable to Uncontrolled Recursion through the .flatten or .isEqual functions that are used without a depth limit. An attacker can cause the application to crash or...

Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack

Impact In simple words, some programs that use .flatten or .isEqual could be made to crash. Someone who wants to do harm may be able to do this on purpose. This can only be done if the program has special properties. It only works in Underscore versions up to 1.13.7. A more detailed explanation...

GHSA-QPX9-HPMF-5GMW Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack

Impact In simple words, some programs that use .flatten or .isEqual could be made to crash. Someone who wants to do harm may be able to do this on purpose. This can only be done if the program has special properties. It only works in Underscore versions up to 1.13.7. A more detailed explanation...

Underscore.js 安全漏洞

Underscore.js is a lightweight JavaScript utility library developed by jashkenas. Versions of Underscore.js prior to 1.13.8 contained a security vulnerability. This vulnerability stemmed from the use of unlimited recursion in the .flatten and .isEqual functions, which could allow attackers to cau...

CVE-2026-27601: Allocation of Resources Without Limits or Throttling

Underscore.js is a utility-belt library for JavaScript. Prior to 1.13.8, the .flatten and .isEqual functions use recursion without a depth limit. Under very specific conditions, detailed below, an attacker could exploit this in a Denial of Service DoS attack by triggering a stack overflow...

PT-2026-22841

Name of the Vulnerable Software and Affected Versions Underscore.js versions prior to 1.13.8 Description The .flatten and .isEqual functions use recursion without a depth limit, which can lead to a stack overflow and a Denial of Service DoS. This occurs when untrusted input is used to create a...

CVE-2025-68156: Allocation of Resources Without Limits or Throttling

Expr is an expression language and expression evaluation for Go. Prior to version 1.17.7, several builtin functions in Expr, including flatten, min, max, mean, and median, perform recursive traversal over user-provided data structures without enforcing a maximum recursion depth. If the evaluation...

PT-2025-54697

Several builtin functions in Expr, including flatten, min, max, mean, and median, perform recursive traversal over user-provided data structures without enforcing a maximum recursion depth. If the evaluation environment contains deeply nested or cyclic data structures, these functions may recurse...

Malicious code in flatten-unflatten (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96678bbed20be5d500dc65bda769b41f7d3666a18c8a76262aca5ed79ef584fd The package flatten-unflatten was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-199215

Malicious code in flatten-unflatten npm...

MAL-2025-191095 Malicious code in flatten-unflatten (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96678bbed20be5d500dc65bda769b41f7d3666a18c8a76262aca5ed79ef584fd The package flatten-unflatten was found to contain malicious code. Source: ghsa-malware...

EUVD-2021-1215

Malware in sbrugna...

EUVD-2022-3906

Malicious code in bioql PyPI...

Malicious code in just-array-flatten (npm)

The package just-array-flatten was found to contain malicious code...

MAL-2025-24110 Malicious code in just-array-flatten (npm)

The package just-array-flatten was found to contain malicious code...

DEBIAN-CVE-2022-50170

In the Linux kernel, the following vulnerability has been resolved: kunit: executor: Fix a memory leak on failure in kunitfiltertests It's possible that memory allocation for 'filtered' will fail, but for the copy of the suite to succeed. In this case, the copy could be leaked. Properly free 'cop...

CVE-2024-36574

A Prototype Pollution issue in flatten-json 1.0.1 allows an attacker to execute arbitrary code via module.exports.unflattenJSON flatten-json/index.js:42...

CVE-2019-10794

All versions of component-flatten are vulnerable to Prototype Pollution. The a function could be tricked into adding or modifying properties of Object.prototype using a proto payload...

SUSE SLED15: jctools / jctools-channels / jctools-experimental / jctools-javadoc / etc (SUSE-SU-2024:4407-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:4407-1 advisory. - CVE-2024-47535: Fixed unsafe reading of large environment files when Netty is loaded by a java...