The vulnerability is an unbounded recursive revive() phase in flatted's parse() function that can cause a stack overflow when parsing JSON objects with deeply nested or self-referential $ indices. The stack overflow crashes the Node.js process, leading to a denial of service. This issue is related to CWE-674 (Uncontrolled Recursion) and CWE-770 (Out-of-Memory Errors).

WebReflection's flatted package is affected. Any installation using a version older than 3.4.0 is vulnerable. The vulnerability was fixed in flatted 3.4.0. Vendors using node.js environments that rely on flatted in any part of the code base fall into the impact zone.

The CVSS score of 7.5 indicates a high severity. The EPSS score is below 1%, suggesting a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is the delivery of a crafted JSON payload to the parse() function, typically from untrusted input. If the application parses data from external sources without validation, an attacker could trigger the stack overflow and cause a denial of service. The exploit does not require privileged access and can be performed remotely by submitting such payload to the vulnerable function.