stream-json CVE-2026-71429

Exploitation requires that the target application uses stream-json's pick, ignore, filter, or replace path filters (from filter-base.js) - specifically not the streamArray, streamObject, or streamValues APIs - and that the application passes attacker-controlled JSON input to those filters without a prior depth check. This covers the library's primary documented use case, including the flagship README example pick({filter: 'data'}). The attack is depth-triggered, not byte-volume-triggered, so a very small document (kilobytes) can cause disproportionate CPU consumption. No authentication or special configuration is required beyond the ability to send JSON to an endpoint backed by these filters. Applications that only use streamArray/streamObject/streamValues, or that pre-validate JSON depth before processing, are not exploitable. Applications operating exclusively on trusted, internally-generated JSON also face no realistic risk.

The NVD-provided CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H scores 6.2 (Medium), but the AV:L attribution is inconsistent with the primary documented threat model: an application receiving untrusted JSON over a network and passing it to a stream-json filter. For such deployments the realistic attack vector is AV:N, yielding a High score. The AC:L and PR:N metrics are accurate - no special complexity and no authentication are required to submit a crafted deeply-nested JSON body. EPSS data is not available in the input; given the absence of a KEV listing and the narrow deployment surface (Node.js streaming-JSON consumers), widespread automated exploitation is unlikely in the near term. However, the availability of a working PoC in the public GHSA advisory lowers the bar for reproduction. Real-world priority depends heavily on deployment context: a public API endpoint that pipes raw request bodies through a pick or filter stream is concretely exploitable; batch pipelines consuming trusted internal JSON face negligible risk. The quadratic nature of the DoS means even moderately deep documents (depth ~2000 in the PoC) produce seconds-long event-loop stalls in Node.js, which is a single-threaded runtime - making this an effective amplification primitive against network-facing services.

An attacker submits a crafted HTTP request body containing a small but deeply nested JSON document (e.g., {'meta':{'meta':{...}}} to depth 2000, roughly 24 KB) to a Node.js web service that pipes the request body through stream-json's pick({filter: 'data'}) filter. The filter recomputes the full path string at each of the ~2000 nesting levels, accumulating O(D²) ≈ 4,000,000 string join operations, blocking the Node.js event loop for several seconds. Repeating this at modest request rates starves all concurrent connections, producing effective denial of service. A proof-of-concept script demonstrating this behavior is published in GHSA-528h-pc64-c93x.