npm/stream-json CVE-2026-114129: medium 6.2
stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service
Action: Upgrade stream-json to 3.7.0 or later.
npm i stream-json@3.7.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.0.0 | 3.7.0 | - |
Fixed versions
| 3.7.0 |
Sources
- osv: GHSA-jj87-hc4r-jwfw
- https://github.com/uhop/stream-json/security/advisories/GHSA-jj87-hc4r-jwfw
- https://nvd.nist.gov/vuln/detail/CVE-2026-114129
- https://github.com/uhop/stream-json/commit/1929fd80495d45b47e8f8cb1d4e132f915aef012
- https://github.com/uhop/stream-json/commit/c06c9a3c02adef89543e26ecebb45837cb284512
- https://github.com/uhop/stream-json
- https://github.com/uhop/stream-json/releases/tag/3.7.0
CVE-2026-114129 · published · modified · JSON