stream-json EUVD-2026-107412

Exploitation requires the consuming application to use stream-json's FlexAssembler with STRING or REGULAR-EXPRESSION path filters in its objectRules or arrayRules on versions 2.0.0 through 3.6.x; consumers using only function filters or no rules at all are NOT affected. The attacker must be able to supply a JSON or JSONC document with deep, unbounded object/array nesting to that assembler, but needs no authentication (PR:N) and no knowledge of the target schema because the costly key-stack join occurs before the rule-match decision. Limiting factors: the vulnerable string/regex-rule configuration is a non-default, specialized usage pattern; the library is documented as intended for trusted input (dumps/exports/logs), so risk hinges on whether untrusted data actually reaches the assembler; and 3.7.0 mitigates by default via a maxDepth=1024 guard that throws RangeError.

This is a CWE-407 algorithmic-complexity denial-of-service with availability-only impact (CVSS 6.2, vector C:N/I:N/A:H) - not an RCE or data-exposure issue, so despite being exploitable without authentication it is a moderate operational-availability concern rather than a top-tier emergency. No EPSS score, KEV listing, or standalone public exploit was provided, and there is no confirmed active exploitation: status is 'no public exploit identified at time of analysis' (note the fix commit does include a depth-based reproducer test, i.e. a trigger is trivially constructible). The single strongest limiting factor is usage-based: only consumers who use FlexAssembler with STRING or REGULAR-EXPRESSION path filters are affected - those using function filters or no rules are not - which narrows real-world applicability well below the raw library install base. There is a signal conflict worth flagging: NVD scores AV:L (local), implying local data processing consistent with the library's documented trust model ('intended input is data the user owns or trusts'), yet the described attack (a crafted document that stalls all concurrent work in a process) is only dangerous when the process feeds UNTRUSTED, often network-delivered, JSON - verify the actual exposure of your deployment. Priority is real but conditional: patch promptly if you run FlexAssembler with string/regex rules against attacker-influenced input; otherwise it is low urgency.

A Node.js service ingests untrusted JSON/JSONC through stream-json's FlexAssembler configured with string or regex path rules. An attacker submits a document nested to a large depth; because the full key stack is joined on every container start before any rule match, CPU cost grows quadratically with depth, stalling the single-threaded event loop and denying service to all concurrent requests. No standalone public exploit exists, but the fix commit's test (a deeply nested object builder) shows how trivially the condition is reached, and AC:L reflects that crafting the payload requires no schema knowledge.