Stream Json
Monthly
Quadratic algorithmic complexity (O(D²)) in stream-json's pick, ignore, filter, and replace path filters allows an attacker supplying a small, deeply-nested JSON document to block the Node.js event loop for seconds to minutes, effectively causing denial of service. The root cause is that filter-base.js recomputes the full dot-separated path string by rejoining the entire nesting stack on every checkable token - so a document of depth D incurs O(D²) CPU work regardless of byte size. All applications passing untrusted or large JSON through a string or RegExp filter (including the library's flagship README example pick({filter: 'data'})) are affected in versions up to and including 3.4.0. A proof-of-concept is included in the published GHSA advisory; no public exploit or CISA KEV listing has been identified at time of analysis.
Quadratic algorithmic complexity (O(D²)) in stream-json's pick, ignore, filter, and replace path filters allows an attacker supplying a small, deeply-nested JSON document to block the Node.js event loop for seconds to minutes, effectively causing denial of service. The root cause is that filter-base.js recomputes the full dot-separated path string by rejoining the entire nesting stack on every checkable token - so a document of depth D incurs O(D²) CPU work regardless of byte size. All applications passing untrusted or large JSON through a string or RegExp filter (including the library's flagship README example pick({filter: 'data'})) are affected in versions up to and including 3.4.0. A proof-of-concept is included in the published GHSA advisory; no public exploit or CISA KEV listing has been identified at time of analysis.