Underscore.js Allocation of Resources Without Limits or Throttling Vulnerability - CVE-2026-27601

Underscore.js is a utility-belt library for JavaScript. Prior to 1.13.8 the _.flatten and _.isEqual functions use recursion without a depth limit. Under very specific conditions detailed below an attacker could exploit this in a Denial of Service (DoS) attack by triggering a stack overflow. Untrusted input must be used to create a recursive datastructure for example using JSON.parse with no enforced depth limit. The datastructure thus created must be passed to _.flatten or _.isEqual. In the case of _.flatten the vulnerability can only be exploited if it is possible for a remote client to prepare a datastructure that consists of arrays at all levels AND if no finite depth limit is passed as the second argument to _.flatten. In the case of _.isEqual the vulnerability can only be exploited if there exists a code path in which two distinct datastructures that were submitted by the same remote client are compared using _.isEqual. For example if a client submits data that are stored in a database and the same client can later submit another datastructure that is then compared to the data that were saved in the database previously OR if a client submits a single request but its data are parsed twice creating two non-identical but equivalent datastructures that are then compared. Exceptions originating from the call to _.flatten or _.isEqual as a result of a stack overflow are not being caught. This vulnerability is fixed in 1.13.8.