uhop stream-json up to 3.4.x Path Filters filter-base.js resource consumption

Summaryinfo

A vulnerability described as problematic has been identified in uhop stream-json up to 3.4.x. The impacted element is an unknown function of the file src/core/filters/filter-base.js of the component Path Filters. The manipulation results in resource consumption. This vulnerability is reported as CVE-2026-71429. The attack requires a local approach. No exploit exists.

Detailsinfo

A vulnerability classified as problematic has been found in uhop stream-json up to 3.4.x. Affected is an unknown code block of the file src/core/filters/filter-base.js of the component Path Filters. The manipulation with an unknown input leads to a resource consumption vulnerability. CWE is classifying the issue as CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. This is going to have an impact on availability. CVE summarizes:

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.5.0, the path filters pick, ignore, filter, and replace in src/core/filters/filter-base.js recompute the full path string from the nesting stack for every checkable token. Because the stack length equals the current nesting depth and a checkable token is emitted at every level, a depth D document costs O(D²) rather than O(D) to process. The issue is triggered by nesting depth rather than byte volume, including the documented pick({filter: 'data'}) traversal-until-match path, so an application that sends untrusted JSON through a string or RegExp filter can block the Node.js event loop and cause denial of service with a small deeply nested document. The streamArray, streamObject, and streamValues streamers are not affected because they use the constant-time asm.depth getter. This issue is fixed in version 3.5.0.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-71429 since 08/06/2026. The exploitability is told to be easy. The attack needs to be approached locally. There are known technical details, but no exploit is available.

Upgrading to version 3.5.0 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• uhop

Name

• stream-json

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4

Website

• Product: https://github.com/uhop/stream-json/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion