CVE-2026-114129 in stream-json
Summary
by MITRE • 10/21/2026
stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. From 2.0.0 until 3.7.0, FlexAssembler compiles string and regular-expression path filters into matchers that join the full key stack on every container start. Because the key stack grows with unbounded object or array nesting, a document nested to depth D causes D joins whose cost grows with the current depth, resulting in quadratic CPU consumption on the single-threaded event loop. The join occurs before the rule match decision, so the attacker does not need to know the target schema. Consumers using only function filters or no rules are not affected. A crafted nested document can stall all concurrent work in a process that feeds it to an affected FlexAssembler. This issue is fixed in 3.7.0, which adds a default maximum depth.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The stream-json library serves as a lightweight utility for processing JSON and JSONC data with minimal memory overhead, relying on streaming components to handle large datasets efficiently. However, versions ranging from 2.0.0 through 3.7.0 contain a significant performance vulnerability within the FlexAssembler component that impacts system stability under specific conditions. This flaw arises when users employ string or regular-expression path filters to select data during parsing. The core technical issue lies in how these filters are compiled into matchers, specifically regarding their interaction with nested JSON structures such as objects and arrays.
When a container start event occurs, the FlexAssembler implementation joins the entire current key stack to evaluate whether the filter matches the target path. As the parser traverses deeper into a document, the key stack grows proportionally with the depth of nesting. Consequently, for every level of nested structure encountered, the system performs a string join operation that scales linearly with the current depth. This results in quadratic CPU consumption relative to the nesting depth D, as the cost of each join increases with every additional layer of indentation or array element. The computational burden is particularly severe because this processing occurs on the single-threaded event loop typical of Node.js environments, meaning no other asynchronous operations can proceed while this expensive computation takes place.
The operational impact of this vulnerability is a denial-of-service condition that affects all concurrent work within the process feeding data to the affected FlexAssembler instance. An attacker does not need prior knowledge of the target schema or specific filter configurations beyond the use of string or regex path filters, as the join operation occurs before any rule match decision is made. By submitting a crafted JSON document with extreme nesting depth, an adversary can stall the event loop indefinitely, effectively freezing the application and preventing it from handling other requests or tasks. This behavior aligns with CWE-400, which describes uncontrolled resource consumption leading to denial of service scenarios.
Mitigation strategies primarily involve upgrading to version 3.7.0 or later, where a default maximum depth limit has been implemented to prevent the key stack from growing beyond safe thresholds. For applications unable to upgrade immediately, developers should consider implementing external validation layers that reject deeply nested JSON payloads before they reach the stream-json parser. Additionally, avoiding string and regular-expression path filters in favor of function-based filters can bypass this specific code path entirely, as those filter types are not affected by the quadratic join behavior. This vulnerability is also relevant to ATT&CK technique T1496, Resource Hijacking, where an attacker uses excessive computational resources to degrade system performance or availability.