Stream Json
Monthly
Deeply nested JSON or JSONC documents fed into stream-json's FlexAssembler between versions 2.0.0 and 3.6.x can pin the Node.js event loop at full CPU, stalling every other operation in the host process. The trigger is the assembler's string and regular-expression path rules, which rebuild a full key-path string on every container start, so nesting depth D produces D joins of average cost D - quadratic work on a single thread. No credentials, no schema knowledge, and no user interaction are required (PR:N/UI:N), and the impact is availability only (C:N/I:N/A:H), making this a moderate operational-availability concern rather than an RCE or data-exposure emergency; no public exploit code was identified at time of analysis. Version 3.7.0 fixes the issue by adding a default maxDepth of 1024 that throws a RangeError for over-deep containers.
Prototype replacement in stream-json before 3.6.0 lets a JSON key literally named __proto__ overwrite the prototype of an assembled object, because Assembler and FlexAssembler wrote properties with plain assignment and thereby invoked the inherited setter instead of creating an own data property. Applications that read authorization, feature-flag, or control-flow values through prototype inheritance from a parsed object - or that call Object.prototype methods on it - can consume attacker-controlled inherited properties or hit runtime errors when the prototype is null; the global Object.prototype is never polluted, so impact is confined to the individual parsed object (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, low integrity and availability impact only). No public exploit code was identified at time of analysis and the issue is not in CISA KEV, but the flaw is genuine and its real-world exposure hinges on a disputed threat model: the maintainer documents intended input as locally owned dumps, exports, and logs (AV:L) while the reporter treats untrusted JSON parsing as part of the library contract, and no authentication or user interaction is required once hostile JSON reaches the parser (PR:N/UI:N).
Quadratic CPU consumption in the JSONC parser and verifier of the stream-json npm package (stream-json/jsonc/parser.js and jsonc/verifier.js) before version 3.6.0 lets an unauthenticated local attacker stall a Node.js process by supplying one large valid block or line comment split across many small input chunks. Only the JSONC code path is affected; the plain JSON parser discards consumed string and number data and is explicitly not vulnerable. Impact is availability-only (CVSS 3.1 6.2, AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - event-loop stall, no confidentiality or integrity loss), and the maintainer frames the vector as local because documented JSONC input is locally owned or user-controlled configuration rather than internet-facing data. No public exploit code identified at time of analysis; a vendor patch is available in 3.6.0.
Quadratic algorithmic complexity (O(D²)) in stream-json's pick, ignore, filter, and replace path filters allows an attacker supplying a small, deeply-nested JSON document to block the Node.js event loop for seconds to minutes, effectively causing denial of service. The root cause is that filter-base.js recomputes the full dot-separated path string by rejoining the entire nesting stack on every checkable token - so a document of depth D incurs O(D²) CPU work regardless of byte size. All applications passing untrusted or large JSON through a string or RegExp filter (including the library's flagship README example pick({filter: 'data'})) are affected in versions up to and including 3.4.0. A proof-of-concept is included in the published GHSA advisory; no public exploit or CISA KEV listing has been identified at time of analysis.
Deeply nested JSON or JSONC documents fed into stream-json's FlexAssembler between versions 2.0.0 and 3.6.x can pin the Node.js event loop at full CPU, stalling every other operation in the host process. The trigger is the assembler's string and regular-expression path rules, which rebuild a full key-path string on every container start, so nesting depth D produces D joins of average cost D - quadratic work on a single thread. No credentials, no schema knowledge, and no user interaction are required (PR:N/UI:N), and the impact is availability only (C:N/I:N/A:H), making this a moderate operational-availability concern rather than an RCE or data-exposure emergency; no public exploit code was identified at time of analysis. Version 3.7.0 fixes the issue by adding a default maxDepth of 1024 that throws a RangeError for over-deep containers.
Prototype replacement in stream-json before 3.6.0 lets a JSON key literally named __proto__ overwrite the prototype of an assembled object, because Assembler and FlexAssembler wrote properties with plain assignment and thereby invoked the inherited setter instead of creating an own data property. Applications that read authorization, feature-flag, or control-flow values through prototype inheritance from a parsed object - or that call Object.prototype methods on it - can consume attacker-controlled inherited properties or hit runtime errors when the prototype is null; the global Object.prototype is never polluted, so impact is confined to the individual parsed object (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, low integrity and availability impact only). No public exploit code was identified at time of analysis and the issue is not in CISA KEV, but the flaw is genuine and its real-world exposure hinges on a disputed threat model: the maintainer documents intended input as locally owned dumps, exports, and logs (AV:L) while the reporter treats untrusted JSON parsing as part of the library contract, and no authentication or user interaction is required once hostile JSON reaches the parser (PR:N/UI:N).
Quadratic CPU consumption in the JSONC parser and verifier of the stream-json npm package (stream-json/jsonc/parser.js and jsonc/verifier.js) before version 3.6.0 lets an unauthenticated local attacker stall a Node.js process by supplying one large valid block or line comment split across many small input chunks. Only the JSONC code path is affected; the plain JSON parser discards consumed string and number data and is explicitly not vulnerable. Impact is availability-only (CVSS 3.1 6.2, AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - event-loop stall, no confidentiality or integrity loss), and the maintainer frames the vector as local because documented JSONC input is locally owned or user-controlled configuration rather than internet-facing data. No public exploit code identified at time of analysis; a vendor patch is available in 3.6.0.
Quadratic algorithmic complexity (O(D²)) in stream-json's pick, ignore, filter, and replace path filters allows an attacker supplying a small, deeply-nested JSON document to block the Node.js event loop for seconds to minutes, effectively causing denial of service. The root cause is that filter-base.js recomputes the full dot-separated path string by rejoining the entire nesting stack on every checkable token - so a document of depth D incurs O(D²) CPU work regardless of byte size. All applications passing untrusted or large JSON through a string or RegExp filter (including the library's flagship README example pick({filter: 'data'})) are affected in versions up to and including 3.4.0. A proof-of-concept is included in the published GHSA advisory; no public exploit or CISA KEV listing has been identified at time of analysis.