{"id":"GHSA-qpx9-hpmf-5gmw","revision":null,"records":[{"revision":"0c2445b12ee745b69f830eb384a5c1de","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-27601","aliases":[],"title":"Underscore.js has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack","description":"Underscore.js is a utility-belt library for JavaScript. Prior to 1.13.8, the _.flatten and _.isEqual functions use recursion without a depth limit. Under very specific conditions, detailed below, an attacker could exploit this in a Denial of Service (DoS) attack by triggering a stack overflow. Untrusted input must be used to create a recursive datastructure, for example using JSON.parse, with no enforced depth limit. The datastructure thus created must be passed to _.flatten or _.isEqual. In the case of _.flatten, the vulnerability can only be exploited if it is possible for a remote client to prepare a datastructure that consists of arrays at all levels AND if no finite depth limit is passed as the second argument to _.flatten. In the case of _.isEqual, the vulnerability can only be exploited if there exists a code path in which two distinct datastructures that were submitted by the same remote client are compared using _.isEqual. For example, if a client submits data that are stored in a database, and the same client can later submit another datastructure that is then compared to the data that were saved in the database previously, OR if a client submits a single request, but its data are parsed twice, creating two non-identical but equivalent datastructures that are then compared. Exceptions originating from the call to _.flatten or _.isEqual, as a result of a stack overflow, are not being caught. This vulnerability is fixed in 1.13.8.","state":0,"publishedAt":"2026-03-03T22:38:38.955+00:00","modifiedAt":"2026-03-04T16:44:40.856+00:00","affected":[{"ecosystem":"Vendor product","name":"underscore","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"jashkenas\",\n                    \"product\": \"underscore\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 1.13.8\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":8.2,"severity":"HIGH"}],"references":["https://github.com/jashkenas/underscore/security/advisories/GHSA-qpx9-hpmf-5gmw","https://github.com/jashkenas/underscore/commit/411e222eb0ca5d570cc4f6315c02c05b830ed2b4","https://github.com/jashkenas/underscore/commit/a6e23ae9647461ec33ad9f92a2ecfc220eea0a84"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-27601","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-27601","identifiers":["CVE-2026-27601"]},"retained":false,"historicalAffected":[]},{"revision":"585d793c30a2475a9ecfb85f11f8f2e7","observedAt":"2026-11-15T09:27:00.374+00:00","statement":{"source":"euvd","id":"EUVD-2026-9341","aliases":["CVE-2026-27601","GHSA-qpx9-hpmf-5gmw"],"title":"Underscore.js is a utility-belt library for JavaScript. Prior to 1.13.8, the _.flatten and _.isEqual functions use recursion without a depth limit. Under very specific conditions, detailed below, an attacker could exploit this in a Denial o…","description":"Underscore.js is a utility-belt library for JavaScript. Prior to 1.13.8, the _.flatten and _.isEqual functions use recursion without a depth limit. Under very specific conditions, detailed below, an attacker could exploit this in a Denial of Service (DoS) attack by triggering a stack overflow. Untrusted input must be used to create a recursive datastructure, for example using JSON.parse, with no enforced depth limit. The datastructure thus created must be passed to _.flatten or _.isEqual. In the case of _.flatten, the vulnerability can only be exploited if it is possible for a remote client to prepare a datastructure that consists of arrays at all levels AND if no finite depth limit is passed as the second argument to _.flatten. In the case of _.isEqual, the vulnerability can only be exploited if there exists a code path in which two distinct datastructures that were submitted by the same remote client are compared using _.isEqual. For example, if a client submits data that are stored in a database, and the same client can later submit another datastructure that is then compared to the data that were saved in the database previously, OR if a client submits a single request, but its data are parsed twice, creating two non-identical but equivalent datastructures that are then compared. Exceptions originating from the call to _.flatten or _.isEqual, as a result of a stack overflow, are not being caught. This vulnerability is fixed in 1.13.8.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":8.2,"severity":null}],"references":["https://github.com/jashkenas/underscore/security/advisories/GHSA-qpx9-hpmf-5gmw","https://github.com/jashkenas/underscore/commit/411e222eb0ca5d570cc4f6315c02c05b830ed2b4","https://github.com/jashkenas/underscore/commit/a6e23ae9647461ec33ad9f92a2ecfc220eea0a84"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-9341","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Mar 3, 2026, 10:38:38 PM","dateUpdated":"Mar 4, 2026, 4:44:40 PM"},"relatedAdvisories":[{"id":"openSUSE-SU-2026:10424-1","title":"jupyter-bqplot-jupyterlab-0.5.46-14.1 on GA media","vulnerabilityIds":["CVE-2026-25547","CVE-2026-27601"]},{"id":"WID-SEC-W-2026-1220","title":"IBM App Connect Enterprise: Mehrere Schwachstellen","vulnerabilityIds":["CVE-2026-26278","CVE-2026-27601","CVE-2026-27903","CVE-2026-27904","CVE-2026-29786","CVE-2026-30827","CVE-2026-31802","CVE-2026-31988","CVE-2026-32141","CVE-2026-33036","CVE-2026-33228"]},{"id":"WID-SEC-W-2026-4090","title":"Oracle Communications: Mehrere Schwachstellen","vulnerabilityIds":["CVE-2021-42576","CVE-2024-38356","CVE-2024-47072","CVE-2024-6763","CVE-2025-13151","CVE-2025-48734","CVE-2025-48924","CVE-2026-10050","CVE-2026-101603","CVE-2026-101604","CVE-2026-101606","CVE-2026-101680","CVE-2026-101758","CVE-2026-101759","CVE-2026-101763","CVE-2026-101764","CVE-2026-101765","CVE-2026-101790","CVE-2026-101791","CVE-2026-101792","CVE-2026-101793","CVE-2026-101807","CVE-2026-13221","CVE-2026-13321","CVE-2026-21441","CVE-2026-21716","CVE-2026-22702","CVE-2026-27601","CVE-2026-28369","CVE-2026-29167","CVE-2026-32327","CVE-2026-34481","CVE-2026-34487","CVE-2026-39892","CVE-2026-41001","CVE-2026-41855","CVE-2026-41989","CVE-2026-45292","CVE-2026-4800","CVE-2026-49844","CVE-2026-54291","CVE-2026-54369","CVE-2026-54399","CVE-2026-5450","CVE-2026-54512","CVE-2026-54874","CVE-2026-54906","CVE-2026-55831","CVE-2026-55858","CVE-2026-55956","CVE-2026-55971","CVE-2026-56130","CVE-2026-56740","CVE-2026-5704","CVE-2026-5795","CVE-2026-58014","CVE-2026-58016","CVE-2026-58389","CVE-2026-5928","CVE-2026-59889","CVE-2026-59901","CVE-2026-59949","CVE-2026-60075","CVE-2026-61674","CVE-2026-63388","CVE-2026-63639","CVE-2026-64193","CVE-2026-6653","CVE-2026-68494","CVE-2026-68497","CVE-2026-68525","CVE-2026-69247","CVE-2026-7168","CVE-2026-75595","CVE-2026-75596","CVE-2026-78030","CVE-2026-83406","CVE-2026-84939","CVE-2026-86219","CVE-2026-8643","CVE-2026-87297","CVE-2026-8763","CVE-2026-91612","CVE-2026-91613","CVE-2026-91614","CVE-2026-91627","CVE-2026-91628","CVE-2026-91629"]},{"id":"WID-SEC-W-2026-2438","title":"Oracle Commerce: Mehrere Schwachstellen","vulnerabilityIds":["CVE-2025-14017","CVE-2025-48976","CVE-2025-68161","CVE-2026-27601","CVE-2026-34316","CVE-2026-34487","CVE-2026-4176","CVE-2026-42403","CVE-2026-42587","CVE-2026-61129","CVE-2026-61130","CVE-2026-61131","CVE-2026-61132","CVE-2026-61133","CVE-2026-61134","CVE-2026-61135","CVE-2026-61136","CVE-2026-61137","CVE-2026-61145","CVE-2026-61146","CVE-2026-61147","CVE-2026-61148","CVE-2026-61149","CVE-2026-61150","CVE-2026-61151","CVE-2026-61152","CVE-2026-61153","CVE-2026-61154","CVE-2026-61155","CVE-2026-61156","CVE-2026-61157","CVE-2026-61158","CVE-2026-61159","CVE-2026-61160","CVE-2026-61161","CVE-2026-61162","CVE-2026-61163","CVE-2026-61164","CVE-2026-61165"]},{"id":"msrc_CVE-2026-27601","title":"Underscore.js has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack","vulnerabilityIds":["CVE-2026-27601"]},{"id":"RHSA-2026:13826","title":"Red Hat Security Advisory: Red Hat Developer Hub 1.9.4 release.","vulnerabilityIds":["CVE-2025-62718","CVE-2025-69534","CVE-2026-1525","CVE-2026-1526","CVE-2026-1528","CVE-2026-2229","CVE-2026-3118","CVE-2026-4800","CVE-2026-4926","CVE-2026-27601","CVE-2026-27904","CVE-2026-29063","CVE-2026-29074","CVE-2026-29186","CVE-2026-32141","CVE-2026-32280","CVE-2026-32282","CVE-2026-33228","CVE-2026-33891","CVE-2026-33894","CVE-2026-33895","CVE-2026-33896","CVE-2026-39983","CVE-2026-40175","CVE-2026-40895"]},{"id":"openSUSE-SU-2026:10427-1","title":"jupyter-matplotlib-0.11.7-17.1 on GA media","vulnerabilityIds":["CVE-2026-27601"]},{"id":"RHSA-2026:24841","title":"Red Hat Security Advisory: Red Hat Developer Hub 1.10.0 release.","vulnerabilityIds":["CVE-2026-2950","CVE-2026-4923","CVE-2026-22036","CVE-2026-27601","CVE-2026-31988","CVE-2026-32235","CVE-2026-33349"]},{"id":"NCSC-2026-0325","title":"Kwetsbaarheden verholpen in Atlassian producten","vulnerabilityIds":["CVE-2021-44906","CVE-2022-3517","CVE-2023-45133","CVE-2025-14813","CVE-2026-0603","CVE-2026-2332","CVE-2026-3505","CVE-2026-4800","CVE-2026-6321","CVE-2026-6322","CVE-2026-10050","CVE-2026-12143","CVE-2026-12151","CVE-2026-12802","CVE-2026-12803","CVE-2026-12816","CVE-2026-13149","CVE-2026-13506","CVE-2026-13676","CVE-2026-14257","CVE-2026-14682","CVE-2026-16221","CVE-2026-18446","CVE-2026-21582","CVE-2026-24734","CVE-2026-25639","CVE-2026-27601","CVE-2026-27606","CVE-2026-29786","CVE-2026-40983","CVE-2026-40984","CVE-2026-41284","CVE-2026-41842","CVE-2026-41845","CVE-2026-41850","CVE-2026-41851","CVE-2026-41907","CVE-2026-42033","CVE-2026-42035","CVE-2026-42041","CVE-2026-42198","CVE-2026-42583","CVE-2026-42587","CVE-2026-43513","CVE-2026-44249","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44490","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496","CVE-2026-45416","CVE-2026-45623","CVE-2026-46625","CVE-2026-47838","CVE-2026-48043","CVE-2026-48779","CVE-2026-48801","CVE-2026-50010","CVE-2026-53434","CVE-2026-54291","CVE-2026-54512","CVE-2026-54513","CVE-2026-55685","CVE-2026-55831","CVE-2026-55833","CVE-2026-56745","CVE-2026-56819","CVE-2026-58059","CVE-2026-58060","CVE-2026-59639","CVE-2026-59642","CVE-2026-59869","CVE-2026-59871","CVE-2026-59873","CVE-2026-59874","CVE-2026-59887","CVE-2026-59901","CVE-2026-67320","CVE-2026-69152","CVE-2026-69192"]},{"id":"WID-SEC-W-2026-2923","title":"Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye, und Jira): Mehrere Schwachstellen","vulnerabilityIds":["CVE-2019-13990","CVE-2021-44906","CVE-2022-1471","CVE-2022-23521","CVE-2022-3517","CVE-2022-41903","CVE-2023-22518","CVE-2023-22522","CVE-2023-22523","CVE-2023-22524","CVE-2023-22527","CVE-2023-45133","CVE-2023-46604","CVE-2025-14813","CVE-2026-0603","CVE-2026-10050","CVE-2026-12143","CVE-2026-12151","CVE-2026-12802","CVE-2026-12803","CVE-2026-12816","CVE-2026-13149","CVE-2026-13506","CVE-2026-13676","CVE-2026-14257","CVE-2026-14682","CVE-2026-16221","CVE-2026-18446","CVE-2026-21582","CVE-2026-2332","CVE-2026-24734","CVE-2026-25639","CVE-2026-27601","CVE-2026-27606","CVE-2026-29786","CVE-2026-3505","CVE-2026-40983","CVE-2026-40984","CVE-2026-41284","CVE-2026-41842","CVE-2026-41845","CVE-2026-41850","CVE-2026-41851","CVE-2026-41907","CVE-2026-42033","CVE-2026-42035","CVE-2026-42041","CVE-2026-42198","CVE-2026-42583","CVE-2026-42587","CVE-2026-43513","CVE-2026-44249","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44490","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496","CVE-2026-45416","CVE-2026-45623","CVE-2026-46625","CVE-2026-47838","CVE-2026-4800","CVE-2026-48043","CVE-2026-48779","CVE-2026-48801","CVE-2026-50010","CVE-2026-53434","CVE-2026-54291","CVE-2026-54512","CVE-2026-54513","CVE-2026-55685","CVE-2026-55831","CVE-2026-55833","CVE-2026-56745","CVE-2026-56819","CVE-2026-58059","CVE-2026-58060","CVE-2026-59639","CVE-2026-59642","CVE-2026-59869","CVE-2026-59871","CVE-2026-59873","CVE-2026-59874","CVE-2026-59887","CVE-2026-59901","CVE-2026-6321","CVE-2026-6322","CVE-2026-67320","CVE-2026-69152","CVE-2026-69192"]},{"id":"openSUSE-SU-2026:12070-1","title":"velociraptor-0.76.7.0.git145.b60ef1146-1.1 on GA media","vulnerabilityIds":["CVE-2025-0914","CVE-2026-12143","CVE-2026-14257","CVE-2026-17535","CVE-2026-18348","CVE-2026-18636","CVE-2026-18638","CVE-2026-18639","CVE-2026-18860","CVE-2026-27601","CVE-2026-29074","CVE-2026-41650","CVE-2026-45623","CVE-2026-49356","CVE-2026-5329","CVE-2026-53550","CVE-2026-55602","CVE-2026-56852","CVE-2026-59869","CVE-2026-6290","CVE-2026-64951","CVE-2026-64952","CVE-2026-64954","CVE-2026-65903","CVE-2026-65912","CVE-2026-65913","CVE-2026-65914","CVE-2026-67314","CVE-2026-67320","CVE-2026-6863","CVE-2026-69152","CVE-2026-69153","CVE-2026-6948","CVE-2026-73086","CVE-2026-73646","CVE-2026-73650","CVE-2026-7572","CVE-2026-7573","CVE-2026-84369","CVE-2026-84370"]},{"id":"openSUSE-SU-2026:10440-1","title":"jupyter-nbclassic-1.3.3-1.1 on GA media","vulnerabilityIds":["CVE-2026-27601"]},{"id":"openSUSE-SU-2026:21448-1","title":"Security update for agama-web-ui","vulnerabilityIds":["CVE-2025-7783","CVE-2026-12143","CVE-2026-13149","CVE-2026-13311","CVE-2026-13676","CVE-2026-27601","CVE-2026-40181","CVE-2026-49356","CVE-2026-53550","CVE-2026-53632","CVE-2026-54466","CVE-2026-54490","CVE-2026-55602"]},{"id":"WID-SEC-W-2026-2437","title":"Oracle Communications: Mehrere Schwachstellen","vulnerabilityIds":["CVE-2025-13151","CVE-2025-14017","CVE-2025-14087","CVE-2025-14821","CVE-2025-31651","CVE-2025-32990","CVE-2025-5318","CVE-2025-64713","CVE-2025-6491","CVE-2025-66418","CVE-2025-70873","CVE-2025-8837","CVE-2025-9900","CVE-2026-0861","CVE-2026-21441","CVE-2026-22747","CVE-2026-2332","CVE-2026-23865","CVE-2026-23903","CVE-2026-24051","CVE-2026-24400","CVE-2026-27099","CVE-2026-27135","CVE-2026-27141","CVE-2026-27601","CVE-2026-28390","CVE-2026-29167","CVE-2026-30922","CVE-2026-31431","CVE-2026-31790","CVE-2026-33557","CVE-2026-34478","CVE-2026-34480","CVE-2026-34481","CVE-2026-34487","CVE-2026-34500","CVE-2026-34520","CVE-2026-39892","CVE-2026-40192","CVE-2026-40976","CVE-2026-4111","CVE-2026-4176","CVE-2026-41855","CVE-2026-41989","CVE-2026-42198","CVE-2026-42587","CVE-2026-42779","CVE-2026-43284","CVE-2026-43500","CVE-2026-4424","CVE-2026-46863","CVE-2026-47007","CVE-2026-4800","CVE-2026-54518","CVE-2026-5588","CVE-2026-5795","CVE-2026-61053","CVE-2026-61091","CVE-2026-61095","CVE-2026-61126","CVE-2026-61127","CVE-2026-61143","CVE-2026-61223","CVE-2026-61224","CVE-2026-61225","CVE-2026-61226","CVE-2026-9256"]},{"id":"RHSA-2026:9742","title":"Red Hat Security Advisory: Red Hat Developer Hub 1.8.6 release.","vulnerabilityIds":["CVE-2025-62718","CVE-2025-69534","CVE-2025-69873","CVE-2026-1525","CVE-2026-1526","CVE-2026-1528","CVE-2026-2229","CVE-2026-3118","CVE-2026-4800","CVE-2026-4926","CVE-2026-25679","CVE-2026-26996","CVE-2026-27601","CVE-2026-27904","CVE-2026-29063","CVE-2026-29074","CVE-2026-29186","CVE-2026-32141","CVE-2026-33036","CVE-2026-33228","CVE-2026-33891","CVE-2026-33894","CVE-2026-33895","CVE-2026-33896","CVE-2026-39983","CVE-2026-40175"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-9341","identifiers":["EUVD-2026-9341","CVE-2026-27601","GHSA-qpx9-hpmf-5gmw"]},"retained":false,"historicalAffected":[]},{"revision":"ccbb3732efc344e5949ec6cc7015bbbf","observedAt":"2026-10-25T06:17:33.365+00:00","statement":{"source":"nvd","id":"CVE-2026-27601","aliases":[],"title":"Underscore.js is a utility-belt library for JavaScript. Prior to 1.13.8, the _.flatten and _.isEqual functions use recursion without a depth limit. Under very specific conditions, detailed below, an attacker could exploit this in a Denial o…","description":"Underscore.js is a utility-belt library for JavaScript. Prior to 1.13.8, the _.flatten and _.isEqual functions use recursion without a depth limit. Under very specific conditions, detailed below, an attacker could exploit this in a Denial of Service (DoS) attack by triggering a stack overflow. Untrusted input must be used to create a recursive datastructure, for example using JSON.parse, with no enforced depth limit. The datastructure thus created must be passed to _.flatten or _.isEqual. In the case of _.flatten, the vulnerability can only be exploited if it is possible for a remote client to prepare a datastructure that consists of arrays at all levels AND if no finite depth limit is passed as the second argument to _.flatten. In the case of _.isEqual, the vulnerability can only be exploited if there exists a code path in which two distinct datastructures that were submitted by the same remote client are compared using _.isEqual. For example, if a client submits data that are stored in a database, and the same client can later submit another datastructure that is then compared to the data that were saved in the database previously, OR if a client submits a single request, but its data are parsed twice, creating two non-identical but equivalent datastructures that are then compared. Exceptions originating from the call to _.flatten or _.isEqual, as a result of a stack overflow, are not being caught. This vulnerability is fixed in 1.13.8.","state":0,"publishedAt":"2026-03-03T23:15:55.56+00:00","modifiedAt":"2026-06-17T10:27:22.407+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · security-advisories@github.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":8.2,"severity":"HIGH"},{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","score":5.9,"severity":"MEDIUM"}],"references":["https://github.com/jashkenas/underscore/commit/411e222eb0ca5d570cc4f6315c02c05b830ed2b4","https://github.com/jashkenas/underscore/commit/a6e23ae9647461ec33ad9f92a2ecfc220eea0a84","https://github.com/jashkenas/underscore/security/advisories/GHSA-qpx9-hpmf-5gmw"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-27601","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-770"],"productCriteria":["cpe:2.3:a:underscorejs:underscore:*:*:*:*:*:node.js:*:*"],"sourceDates":{"published":"2026-03-03T23:15:55.560","lastModified":"2026-06-17T10:27:22.407"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-27601","identifiers":["CVE-2026-27601"]},"retained":false,"historicalAffected":[]},{"revision":"8ef2a872c8094613be3cc78e6cc9fbfe","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-qpx9-hpmf-5gmw","aliases":["CVE-2026-27601"],"title":"Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack","description":"### Impact\n\nIn simple words, some programs that use `_.flatten` or `_.isEqual` could be made to crash. Someone who wants to do harm may be able to do this on purpose. This can only be done if the program has special properties. It only works in Underscore versions up to 1.13.7. A more detailed explanation follows.\n\nIn affected versions of Underscore, the `_.flatten` and `_.isEqual` functions use recursion without a depth limit. Under very specific conditions, detailed below, an attacker could exploit this in a Denial of Service (DoS) attack by triggering a stack overflow.\n\nA proof of concept (PoC) for this type of attack with `_.isEqual`:\n\n```js\nconst _ = require('underscore');\n\n// build JSON string for nested object ~4500 levels deep\n// (for this to be an attack, the JSON would have to come from\n// a request or other untrusted input)\nlet json = '';\nfor (let i = 0; i < 4500; i++) json += '{\"n\":';\njson += '\"x\"';\nfor (let i = 0; i < 4500; i++) json += '}';\n\n// construct two distinct objects with equal shape from the above JSON\nconst a = JSON.parse(json);\nconst b = JSON.parse(json);\n\n_.isEqual(a, b); // RangeError: Maximum call stack size exceeded\n```\n\nA proof of concept (PoC) for this type of attack with `_.flatten`:\n\n```js\nconst _ = require('underscore');\n\n// build nested array ~4500 levels deep\n// (like with _.isEqual, this nested array would have to be sourced\n// from an untrusted external source for it to be an attack)\nlet nested = [];\nfor (let i = 0; i < 4500; i++) nested = [nested];\n\n_.flatten(nested); // RangeError: Maximum call stack size exceeded\n```\n\nAn application that crashes because of this can be restarted, so the bug is most relevant to applications for which continued operation is important, such as server applications. Furthermore, an application is only vulnerable to this type of attack if ALL of the following conditions are met:\n\n- Untrusted input must be used to create a recursive datastructure, for example using `JSON.parse`, with no enforced depth limit.\n- The datastructure thus created must be passed to `_.flatten` or `_.isEqual`.\n- In the case of `_.flatten`, the vulnerability can only be exploited if it is possible for a remote client to prepare a datastructure that consists of arrays at all levels AND if no finite depth limit is passed as the second argument to `_.flatten`.\n- In the case of `_.isEqual`, the vulnerability can only be exploited if there exists a code path in which two distinct datastructures that were submitted by the same remote client are compared using `_.isEqual`. For example, if a client submits data that are stored in a database, and the same client can later submit another datastructure that is then compared to the data that were saved in the database previously, OR if a client submits a single request, but its data are parsed twice, creating two non-identical but equivalent datastructures that are then compared.\n- Exceptions originating from the call to `_.flatten` or `_.isEqual`, as a result of a stack overflow, are not being caught.\n\nAll versions of Underscore up to and including 1.13.7 are affected by this weakness.\n\n### Patches\n\nThe problem has been patched in version 1.13.8. Upgrading to 1.13.8 or later completely prevents exploitation.\n\n**Note:** historically, there have been breaking changes in minor releases of Underscore, especially between versions 1.6 and 1.9. However, upgrading from version 1.9 or later to any later 1.x version should be feasible with little or no effort for all users.\n\n### Workarounds\n\nA workaround that works for both functions is to enforce a depth limit on the datastructure that is created from untrusted input. A limit of 1000 levels should prevent attacks from being successful on most systems. In systems with highly constrained hardware, we recommend lower limits, for example 100 levels.\n\nAnother possible workaround that only works for `_.flatten`, is to pass a second argument that limits the flattening depth to 1000 or less.\n\n### References\n\n- https://github.com/jashkenas/underscore/issues/3011\n- https://underscorejs.org/#1.13.8\n- https://underscorejs.org/#flatten\n- https://underscorejs.org/#isEqual","state":0,"publishedAt":"2026-03-03T17:46:06+00:00","modifiedAt":"2026-09-10T03:51:00.75242+00:00","affected":[{"ecosystem":"npm","name":"underscore","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.13.8"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/jashkenas/underscore/security/advisories/GHSA-qpx9-hpmf-5gmw","https://nvd.nist.gov/vuln/detail/CVE-2026-27601","https://github.com/jashkenas/underscore/issues/3011","https://github.com/jashkenas/underscore/commit/411e222eb0ca5d570cc4f6315c02c05b830ed2b4","https://github.com/jashkenas/underscore/commit/a6e23ae9647461ec33ad9f92a2ecfc220eea0a84","https://github.com/jashkenas/underscore","https://underscorejs.org/#1.13.8","https://underscorejs.org/#flatten","https://underscorejs.org/#isEqual"],"sourceUrl":"https://github.com/advisories/GHSA-qpx9-hpmf-5gmw","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-qpx9-hpmf-5gmw","identifiers":["GHSA-qpx9-hpmf-5gmw","CVE-2026-27601"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-15T11:05:17.2943378+00:00","complete":true,"records":1781,"lastAttemptAt":"2026-11-15T11:05:17.2943378+00:00","lastSuccessAt":"2026-11-15T11:05:17.4673918+00:00","error":null,"lastVerifiedAt":"2026-11-15T11:05:17.4673928+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-7de4d7559a5263003f03d9f70577ab06f92ba4178309f26fce53e22a4a959294-f90179050d1e68c26defb06294e68ca9aad67fa6285a72a309f2510089445b08","complete":true,"records":425787,"lastAttemptAt":"2026-11-15T11:01:58.8542146+00:00","lastSuccessAt":"2026-11-15T11:01:58.8389797+00:00","error":null,"lastVerifiedAt":"2026-11-15T11:01:58.8542146+00:00","snapshotPublishedAt":"2026-11-15T10:28:09+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-f981543109394c8f9b3df5737aa835e7","complete":false,"records":13821,"lastAttemptAt":"2026-11-15T11:15:00.6236179+00:00","lastSuccessAt":"2026-11-15T11:15:00.619+00:00","error":"257 identifier lookups failed; latest failures include AccessDenied (HTTP 403). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-15T11:15:00.619+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13558,"expectedIdentifiers":13874,"failedIdentifiers":257},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-15T11:05:17.2943378+00:00","complete":true,"records":1125,"lastAttemptAt":"2026-11-15T11:05:17.2943378+00:00","lastSuccessAt":"2026-11-15T11:05:17.4693563+00:00","error":null,"lastVerifiedAt":"2026-11-15T11:05:17.4693566+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-d33b5144615b488f88b7a7390696bc39","complete":true,"records":13833,"lastAttemptAt":"2026-11-15T11:05:18.0594066+00:00","lastSuccessAt":"2026-11-15T10:02:36.038+00:00","error":null,"lastVerifiedAt":"2026-11-15T10:02:36.038+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13874,"expectedIdentifiers":13874,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-64eea06dbd27de8464d5dbce1b78cc794cc59e2d901516ae0d3ea76e624cdae0","complete":true,"records":9955,"lastAttemptAt":"2026-11-15T11:05:12.198625+00:00","lastSuccessAt":"2026-11-14T13:57:23.1208135+00:00","error":null,"lastVerifiedAt":"2026-11-15T11:05:12.198625+00:00","snapshotPublishedAt":"2026-11-14T13:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-f4424d7d4861b1af1404bd15abcb83f295dcd003412a9340ca99dc8200aa148a","complete":true,"records":2014,"lastAttemptAt":"2026-11-15T11:01:59.0034935+00:00","lastSuccessAt":"2026-11-13T19:57:08.2864435+00:00","error":null,"lastVerifiedAt":"2026-11-15T11:01:59.0034935+00:00","snapshotPublishedAt":"2026-11-13T19:33:10+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-6086d649bcb454cdf302d7d9275177bda73550e1b6e446b3520e9b6266d3582c","complete":true,"records":3148,"lastAttemptAt":"2026-11-15T11:05:17.2566792+00:00","lastSuccessAt":"2026-11-15T11:05:17.1034234+00:00","error":null,"lastVerifiedAt":"2026-11-15T11:05:17.2566792+00:00","snapshotPublishedAt":"2026-11-15T10:03:04+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-ff18f36f13fcca3a20a3fb9274b59b8872d18869a99071730e1e79b625c8f612","complete":true,"records":232475,"lastAttemptAt":"2026-11-15T11:05:12.0533004+00:00","lastSuccessAt":"2026-11-15T11:05:10.4195883+00:00","error":null,"lastVerifiedAt":"2026-11-15T11:05:12.0533004+00:00","snapshotPublishedAt":"2026-11-15T10:33:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}