The flatted library for Node.js is susceptible to a denial of service attack due to improper handling of deeply nested JSON structures, which can crash the host process.

The vulnerability exists in the parse() function, which utilizes a recursive revive() phase. An unauthenticated attacker can supply a crafted payload containing deeply nested or self-referential indices to trigger an uncontrolled recursion, leading to a stack overflow and subsequent process crash.

The exploitation of this vulnerability results in a denial of service for any application relying on the flatted library for JSON deserialization. Given the CVSS score of 7.5, this is a high-severity issue that could lead to significant system downtime and service disruption. Organizations relying on this package for processing user-supplied JSON data are at particular risk of targeted application crashes.

Immediate Action: Update the flatted package to version 3.4.0 or later to include the necessary fix for recursive deserialization.

Proactive Monitoring: Monitor application logs for repeated Node.js process crashes or unexpected termination events that coincide with incoming JSON payload processing.

Compensating Controls: Implement strict input validation or size limits on incoming JSON payloads to prevent the submission of excessively deep or malformed structures before they reach the parser.

Public Exploit Available: No (exploit_available: unknown)

This vulnerability represents a significant availability risk for Node.js environments. Security teams should prioritize updating the flatted dependency to version 3.4.0 immediately to eliminate the risk of remote process crashes caused by crafted JSON payloads.