CVE-2026-104182 in stream-json
Summary
by MITRE • 10/02/2026
stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, the JSONC parser at stream-json/jsonc/parser.js and verifier at stream-json/jsonc/verifier.js restart comment-terminator scanning from the opening slash whenever a block or line comment spans an input chunk, while retaining the accumulated comment buffer. Delivering a large valid comment across many small chunks therefore causes quadratic CPU work and can stall the Node.js event loop. The maintainer characterizes the attack vector as local because the documented JSONC input is locally owned or user-controlled configuration, rather than input intended for the open internet. This JSONC-only scope does not include the plain JSON parser, which advances through and discards consumed string and number data. This issue is fixed in version 3.6.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/02/2026
The stream-json library provides a set of streaming components designed to process JSON and JSONC formats with an emphasis on minimal memory consumption. A critical performance vulnerability was identified within the JSONC parser located at stream-json/jsonc/parser.js and its corresponding verifier in stream-json/jsonc/verifier.js, specifically affecting versions prior to 3.6.0. This flaw manifests as a resource exhaustion issue where the parsing logic fails to efficiently handle multi-chunk inputs containing comments that span across multiple data chunks. The vulnerability is classified under CWE-400, which denotes uncontrolled resource consumption, and aligns with ATT&CK technique T1499, specifically endpoint denial of service via application or system exploitation.
The technical root cause lies in the comment-terminator scanning mechanism used by the JSONC parser. When a block or line comment spans across an input chunk boundary, the parser incorrectly restarts its search for the comment terminator from the opening slash character every time it processes a new chunk. Crucially, while the scanner resets its position to re-scan previously processed content, it retains the accumulated buffer of characters already identified as part of the comment. This design flaw creates a scenario where processing large comments distributed across many small input chunks results in quadratic CPU complexity relative to the size of the comment and the number of chunks. Instead of linearly advancing through the data, the parser repeatedly re-evaluates segments it has already processed, leading to significant computational overhead.
The operational impact of this vulnerability is a potential denial of service against Node.js applications that utilize stream-json for parsing JSONC input. Because JavaScript runs on a single-threaded event loop, excessive CPU consumption by one task can stall the entire application, preventing it from handling other requests or tasks. An attacker who can control or influence the structure and chunking of incoming JSONC data could trigger this behavior intentionally to degrade service availability. Although the maintainer characterizes the attack vector as local because typical usage involves locally owned or user-controlled configuration files rather than open internet input, any scenario where external parties can dictate the format or volume of parsed content poses a risk. The vulnerability is strictly scoped to JSONC parsing; the plain JSON parser does not exhibit this behavior as it correctly advances through and discards consumed string and number data without re-scanning.
Mitigation for this issue involves upgrading stream-json to version 3.6.0 or later, where the scanning logic has been corrected to avoid redundant processing of previously scanned content. For applications that cannot immediately upgrade, implementing input validation to limit comment length or ensuring that JSONC payloads are not split into excessively small chunks can reduce the likelihood of triggering the quadratic behavior. Additionally, monitoring CPU usage and event loop latency in production environments may help detect anomalous parsing activity indicative of this vulnerability being exploited.