CVE-2026-71429
1 advisory.
npm/stream-json CVE-2026-71429: medium 6.2, EPSS 0.16%
stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)
Action: Upgrade stream-json to 3.5.0 or later.
npm i stream-json@3.5.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.5.0 | - |
Fixed versions
| 3.5.0 |
Sources
- osv: GHSA-528h-pc64-c93x
- https://github.com/uhop/stream-json/security/advisories/GHSA-528h-pc64-c93x
- https://github.com/uhop/stream-json/commit/a869fb98aaef9225556f49901a8f55954ff856e6
- https://github.com/uhop/stream-json
CVE-2026-71429 · published · modified · JSON