Skip to content
COOEY

FAIL › dossier

flatted

PRODUCT

Failure events
1
Zero-days
1
RCEs
1
On KEV
0
Critical
1
Worst shame
50
Dossier not yet built — the RAG curator builds one for players with ≥2 failure events. The failure history and sentiment below are live.
FAILURE HISTORY · 1
DATEEVENTSEVSUMMARY
2026-03-20 CVE-2026-33228 critical flatted is a circular JSON parser. Prior to version 3.4.2, the parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index keys, without validating that they are numeric. Since the internal input buffer is a JavaScript Array, a