CVE-2026-33228: flatted is a circular JSON parser

This week

CRITICAL 9.8REMOTEUPGRADE

CVE-2026-33228 is a critical-severity flaw (CVSS 9.8) affecting flatted. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

flatted is a circular JSON parser. Prior to version 3.4.2, the parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index keys, without validating that they are numeric. Since the internal input buffer is a JavaScript Array, accessing it with the key "__proto__" returns Array.prototype via the inherited getter. This object is then treated as a legitimate parsed value and assigned as a property

Why this priority

Critical severity
Public exploit reference
CISA SSVC: automatable with total technical impact
Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score	9.8 (Critical)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	0.8% (top 42%)
CISA exploited list	No
Weakness	CWE-1321, CWE-915
Published	2026-03-20
Last modified	2026-09-04

Publisher (CNA): GitHub, Inc. · Vendor: webreflection

Last updated 2026-09-04 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2026-03-20 23:16 UTCPublished CVE record published
2026-09-04 13:18 UTCUpdated Record last modified

webreflection flatted UPGRADE

Affected: < 3.4.2

Fixed in: 3.4.2

Safe to downgrade to: no unaffected older release

1. Check installed version

npm ls flatted

2. UPGRADE to 3.4.2

npm install flatted@">=3.4.2"

Exact fixes by distribution

npm · flatted · FIXED · 3.4.2 · vulnerable: <= 3.4.1 · source

npm install flatted@">=3.4.2" npm ls flatted

Fedora 46 · wordpress · FIXED · 7.1.4-1.fc46 · FEDORA-2026-907394725e · source

sudo dnf upgrade --advisory=FEDORA-2026-907394725e

Fedora ELN · rhc · FIXED · 0.3.15-1.eln159 · FEDORA-2026-1cd9f35750 · source

sudo dnf upgrade --advisory=FEDORA-2026-1cd9f35750

Debian 12 · node-flatted · NO FIX YET

Debian 13 · node-flatted · FIXED · 3.2.7~ds-1+deb13u1

sudo apt update && sudo apt install --only-upgrade node-flatted dpkg --compare-versions "$(dpkg-query -W -f='${Version}' node-flatted)" ge "3.2.7~ds-1+deb13u1" && echo PATCHED || echo STILL-VULNERABLE

RHEL 10 · rust · NOT AFFECTED

RHEL 8 · grafana · NOT AFFECTED

RHEL 8 · pcs · NOT AFFECTED

RHEL 9 · grafana · NOT AFFECTED

RHEL 9 · pcs · NOT AFFECTED

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-33228?

flatted: upgrade to 3.4.2. Exact commands for each OS are on this page.

Is CVE-2026-33228 being exploited?

CVE-2026-33228 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-33228 affect?

CVE-2026-33228 affects flatted. Severity is critical (CVSS 9.8). flatted is a circular JSON parser. Prior to version 3.4.2, the parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index keys, without validating that they are numeric. Since the intern

How urgent is CVE-2026-33228?

Priority 62/100. Critical severity; Public exploit reference; CISA SSVC: automatable with total technical impact; Remotely exploitable, no login, no user action

Related CVEs

CVE-2026-32141 HIGH 7.5 UPGRADE flatted is a circular JSON parser

References

← Back to latest CVEs