Skip to content
fr Sign in
8.9 High

CVE-2026-33228 flatted is a circular JSON parser

Description

flatted is a circular JSON parser. Prior to version 3.4.2, the parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index keys, without validating that they are numeric. Since the internal input buffer is a JavaScript Array, accessing it with the key "__proto__" returns Array.prototype via the inherited getter. This object is then treated as a legitimate parsed value and assigned as a property of the output object, effectively leaking a live reference to Array.prototype to the consumer. Any code that subsequently writes to that property will pollute the global prototype. This issue has been patched in version 3.4.2.

Affected products and versions

Product Affected versions Fixed in
Red Hat Developer Hub 1.8 1776784286 earliest → < 1776784286 1776784286
Red Hat Developer Hub 1.9 1777903262 earliest → < 1777903262 1777903262
Red Hat 3scale API Management Platform 2 Versions not published
Red Hat Build of Keycloak Versions not published
Red Hat Single Sign-On 7 Versions not published
Cryostat 4 Versions not published
Logging Subsystem for Red Hat OpenShift Versions not published
Multicluster Engine for Kubernetes Versions not published
Red Hat Advanced Cluster Management for Kubernetes 2 Versions not published
Show the 23 other branches
Product Affected versions Fixed in
Red Hat AMQ Broker 7 Versions not published
Red Hat build of Apicurio Registry 2 Versions not published
Red Hat build of OptaPlanner 8 Versions not published
Red Hat Build of Podman Desktop Versions not published
Red Hat Data Grid 8 Versions not published
Red Hat Directory Server 11 Versions not published
Red Hat Directory Server 12 Versions not published
Red Hat Directory Server 13 Versions not published
Red Hat Enterprise Linux 10 Versions not published
Red Hat Enterprise Linux 8 Versions not published
Red Hat Enterprise Linux 9 Versions not published
Red Hat Fuse 7 Versions not published
Red Hat JBoss Enterprise Application Platform 7 Versions not published
Red Hat JBoss Enterprise Application Platform 8 Versions not published
Red Hat JBoss Enterprise Application Platform Expansion Pack Versions not published
Red Hat OpenShift AI (RHOAI) Versions not published
Red Hat OpenShift Container Platform 4 Versions not published
Red Hat Process Automation 7 Versions not published
Red Hat Quay 3 Versions not published
streams for Apache Kafka 2 Versions not published
streams for Apache Kafka 3 Versions not published
flatted 3.4 earliest → < 3.4.2 3.4.2
Cluster Observability Operator 1.5.0 1782839996 earliest → < 1782839996 1782839996

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Red Hat Developer Hub 1.8

The 45 CVEs of Red Hat Developer Hub 1.8 →
CVE-2026-41674 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module 8.7 High CVE-2026-6321 fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize()… 7.5 High CVE-2026-42039 Axios is a promise based HTTP client for the browser and Node.js 6.9 Medium CVE-2026-42041 Axios is a promise based HTTP client for the browser and Node.js 4.8 Medium
Track this CVE