CVE-2026-27601
Stack Overflow DoS in Underscore.js _.flatten and _.isEqual
Publication date: 2026-03-03
Last updated on: 2026-04-28
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| underscorejs | underscore | to 1.13.8 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-770 | The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Underscore.js library prior to version 1.13.8, specifically in the _.flatten and _.isEqual functions. These functions use recursion without a depth limit, which under very specific conditions can be exploited by an attacker to cause a stack overflow, leading to a Denial of Service (DoS) attack.
To exploit this, an attacker must supply untrusted input that creates a deeply recursive data structure, for example by using JSON.parse without enforcing a depth limit. This data structure is then passed to _.flatten or _.isEqual.
For _.flatten, exploitation requires that the data structure consists only of arrays at all levels and that no finite depth limit is provided as the second argument. For _.isEqual, exploitation requires a scenario where two distinct but equivalent data structures submitted by the same remote client are compared.
If a stack overflow occurs during these function calls, exceptions are not caught, which can crash the application or cause it to become unresponsive.
How can this vulnerability impact me? :
This vulnerability can lead to a Denial of Service (DoS) attack against applications using vulnerable versions of Underscore.js. An attacker can cause the application to crash or become unresponsive by triggering a stack overflow through specially crafted recursive data structures.
Such an attack can disrupt service availability, potentially affecting users and business operations that rely on the affected application.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade the Underscore.js library to version 1.13.8 or later, where the issue is fixed.
Additionally, avoid passing untrusted input that creates deeply recursive data structures to the _.flatten or _.isEqual functions without enforcing a finite depth limit.