# What changed in flatted

> 2 changes in flatted 3 from its official release notes, upgrade guides and advisories: 2 security. Each one cited. Sources checked 2026-10-20. HTML: https://unstale.sh/npm/flatted/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## flatted 3

### Security

- Prototype Pollution via parse() in NodeJS flatted (3.4.2) — [security advisory](https://github.com/advisories/GHSA-RF6F-7FWH-WJGH)
- flatted vulnerable to unbounded recursion DoS in parse() revive phase (3.4.0) — [security advisory](https://github.com/advisories/GHSA-25H7-PFQ9-P65F)