Denial of Service Vulnerability in stream-json by uh-mixedproducts

CVE-2026-71429

What is CVE-2026-71429?

The stream-json library, designed for efficient processing of JSON and JSONC data, has a vulnerability in its path filters that can lead to denial of service. Prior to version 3.5.0, the library recalculates path strings based on the nesting depth of JSON documents. This inefficiency means that a deeply nested structure can cause performance issues, rapidly consuming resources and blocking the Node.js event loop. Applications using string or RegExp filters to process untrusted JSON data are particularly at risk, as attackers can exploit this behavior with minimally sized but deeply nested payloads. The issues have been addressed in version 3.5.0, ensuring stable application performance.

References