JSON Processing Vulnerability in stream-json by uhop
CVE-2026-114129

6.2MEDIUM

Key Information:

Vendor

Uhop

Status
Stream-json
Vendor
CVE Published:
21 October 2026

What is CVE-2026-114129?

The stream-json library has a vulnerability in its FlexAssembler component that may lead to excessive CPU consumption when processing deeply nested JSON documents. This occurs due to unbounded object or array nesting, causing the key stack to grow significantly. As a result, an attacker can craft a nested document that stalls all concurrent processing, impacting overall performance. The issue has been addressed in version 3.7.0, which introduces a default maximum nesting depth to prevent these performance issues.

Affected Version(s)

stream-json >= 2.0.0, < 3.7.0

References

https://github.com/uhop/stream-json/security/advisories/G...
x_refsource_CONFIRM
https://github.com/uhop/stream-json/commit/1929fd80495d45...
x_refsource_MISC
https://github.com/uhop/stream-json/commit/c06c9a3c02adef...
x_refsource_MISC

CVSS V3.1

Score:
6.2
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.