{"action":"Upgrade stream-json to 3.5.0 or later.","affected":[{"fixed":"3.5.0","introduced":"0"}],"component":"stream-json","cve_ids":["CVE-2026-71429"],"ecosystem":"npm","epss":0.0016,"exploited":false,"fixed_versions":["3.5.0"],"ghsa_id":"GHSA-528h-pc64-c93x","id":"tcs_01M5KF24BZFJ25SA57F8SXTRR8","modified_at":"2026-09-10T03:51:15.101198704Z","published_at":"2026-09-03T20:27:53Z","references":["https://osv.dev/vulnerability/GHSA-528h-pc64-c93x","https://github.com/uhop/stream-json/security/advisories/GHSA-528h-pc64-c93x","https://github.com/uhop/stream-json/commit/a869fb98aaef9225556f49901a8f55954ff856e6","https://github.com/uhop/stream-json"],"severity":{"label":"medium","score":6.2},"sources":[{"source":"osv","source_id":"GHSA-528h-pc64-c93x","url":"https://osv.dev/vulnerability/GHSA-528h-pc64-c93x"}],"summary":"stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)"}