stream-json EUVD-2026-91056

Exploitation requires that the application use stream-json's JSONC code path specifically - the parser at stream-json/jsonc/parser.js or verifier at stream-json/jsonc/verifier.js (the plain JSON parser is NOT affected because it discards consumed data) - on a version prior to 3.6.0. The attacker must be able to supply JSONC input as many small chunks containing one large valid block (/* */) or line (//) comment, so a chunked/streaming input source is a prerequisite. Limiting factors: the vector is LOCAL (AV:L), and the library documents JSONC input as locally-owned or user-controlled configuration rather than internet-facing data, so an attacker needs a local path to feed malicious JSONC; there is no confidentiality or integrity impact, only availability (event-loop stall).

This is a genuine but low-urgency availability issue, not a high-impact priority. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 6.2) is driven entirely by a High availability impact with no confidentiality or integrity effect - consistent with CWE-407 (Inefficient Algorithmic Complexity): a quadratic comment-scan that can stall the Node.js event loop (DoS). Critically, the attack vector is LOCAL (AV:L), and the maintainer explicitly scopes JSONC input as locally-owned/user-controlled configuration, not internet-facing data; the README even warns against feeding untrusted JSON/JSONC to the library. No EPSS score, KEV listing, or POC was provided in the input, so there is no exploitation-probability or active-exploitation signal to weigh. There is a tension worth flagging: PR:N (no privileges) combined with AV:L means an attacker still needs a local delivery path (the ability to supply the malicious JSONC file/stream) but no authentication once they do - verify the realistic threat model against your deployment, since the vendor's stated design intent (trusted input only) sharply narrows real-world exploitability. Net: a real correctness/DoS bug worth patching, but low operational risk absent a path for untrusted JSONC to reach the parser.

An application uses stream-json's JSONC parser to process a configuration or data file whose contents an attacker can influence (e.g., a locally-supplied config in a multi-tenant or CI context). The attacker crafts one large, valid block or line comment and feeds it across many small input chunks; the parser repeatedly rescans the comment terminator from the opening slash while retaining the buffer, producing quadratic CPU work that stalls the Node.js event loop and denies service. No public exploit code was identified in the provided data, and the low-complexity (AC:L) but local (AV:L) vector means the attacker must first control the JSONC input path.