Affected: WebReflection flatted, Red Hat Cluster Observability Operator 1.5.0, Red Hat Developer Hub 1.8, Red Hat Developer Hub 1.9, Red Hat Edge Manager 1.0, Red Hat Edge Manager 1.1, Red Hat OpenShift AI 2.16, Red Hat OpenShift Dev Spaces 3.28, Red Hat Cryostat 4, Red Hat Logging Subsystem for Red Hat OpenShift and 22 more

flatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process. This vulnerability is fixed in 3.4.0.