Underscore.js, a widely used utility library for JavaScript, contained a flaw in its _.flatten and _.isEqual functions before version 1.13.8. Both functions recurse without a depth limit, so a deliberately nested data structure can trigger a stack overflow when these functions process the data. The overflow causes the process to terminate or hang, resulting in a denial‑of‑service condition. The weakness corresponds to unchecked loop condition and uncontrolled recursion (CWE‑606, CWE‑770).

The vulnerability affects all v1.13.8‑earlier releases of the Underscore.js library distributed by jashkenas. Any Node.js or web application that includes a pre‑1.13.8 version of Underscore.js and calls _.flatten or _.isEqual on data supplied by an unauthenticated or untrusted source is at risk. The CVE details list the CPE for underscorejs:underscore and emphasize that the issue is present in all earlier versions.

With a CVSS base score of 8.2, the flaw is considered high‑severity. The EPSS score of less than 1% indicates that, currently, there is a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. However, the attack scenario requires an attacker to be able to supply deeply nested JSON or equivalent data structures that are fed directly into the vulnerable functions. The effective attack vector is thus remote client input; any exposed API, form, or data ingestion endpoint that calls _.flatten or _.isEqual without input validation can potentially be abused to perform a denial‑of‑service via stack overflow.