hughsk flat

• CVE-2026-119051 Medium 5.9 flat through 6.0.1 Denial of Service via unflatten() Numeric Array Index Keys 0.3%
• CVE-2020-36632 Medium 6.3 hughsk flat index.js unflatten prototype pollution 1.2%