CVE-2026-104183
1 advisory.
npm/stream-json CVE-2026-104183: medium 5.1, EPSS 0.19%
stream-json has a prototype pollution issue: Assembler writes this.current[this.key] on plain objects
Action: Upgrade stream-json to 3.6.0 or later.
npm i stream-json@3.6.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.6.0 | - |
Fixed versions
| 3.6.0 |
Sources
- osv: GHSA-mjw6-4jj6-33hc
- https://github.com/uhop/stream-json/security/advisories/GHSA-mjw6-4jj6-33hc
- https://nvd.nist.gov/vuln/detail/CVE-2026-104183
- https://github.com/uhop/stream-json/commit/2f2d35bbb547306991ded6487a279154d865a358
- https://github.com/uhop/stream-json
- https://github.com/uhop/stream-json/releases/tag/3.6.0
CVE-2026-104183 · published · modified · JSON