Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2026-27601

21
FAUCET Score

CVE-2026-27601 describes a Denial of Service (DoS) vulnerability in Underscore.js versions prior to 1.13.8, affecting the _.flatten and _.isEqual functions. This flaw allows an unauthenticated attacker to trigger a stack overflow by providing specially crafted, deeply recursive input, leading to application unavailability. While the attack complexity is low, specific conditions regarding data structure and comparison paths must be met for successful exploitation. There is currently no evidence of active exploitation, nor are there public exploit codes or significant community discussion surrounding this vulnerability.

Impacted Technologies

VendorProductVersion(s)CPE
< 1.13.8CPE matchmatch criteria
cpe:2.3:a:underscorejs:underscore:*:*:*:*:*:node.js:*:*

CVSS Data

CVSS version used by this source: 4.0

8.2HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
PRESENT
Privileges Required
NONE
User Interaction
NONE
VS Confidentiality
NONE
VS Integrity
NONE
VS Availability
HIGH
SS Confidentiality
NONE
SS Integrity
NONE
SS Availability
NONE
Exploit Maturity
NOT_DEFINED
CvssVersion
4.0

Exploit Intelligence

EPSS Score
0.61%
Probability of exploitation in next 30 days
EPSS Percentile
45.7%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0061 is in the 29th percentile among its peer group of 23,705 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (2)

github_advisorypatch availablevia nvd_reference
View patch
npmpatch availablevia ghsa
Product: underscoreFixed in: 1.13.8

Vendor Advisories (2)

microsoft2026-Mar/CVE-2026-27601Important

Underscore.js has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack

Mar 10, 2026
npmGHSA-qpx9-hpmf-5gmwhigh

Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack

Mar 3, 2026

References

github.com / jashkenas/underscore/commit/411e222eb0ca5d570cc4f6315c02c05b830ed2b4
Patch
github.com / jashkenas/underscore/commit/a6e23ae9647461ec33ad9f92a2ecfc220eea0a84
Patch
github.com / jashkenas/underscore/security/advisories/GHSA-qpx9-hpmf-5gmw
ExploitPatchVendor Advisory