26 matches found
stream-json/jsonc parser JSONC DoS
The vulnerability in the stream-json/jsonc/parser.js and stream-json/jsonc/verifier.js libraries for processing JSON and JSONC streams is related to inefficient algorithmic complexity. Exploiting this vulnerability can allow attackers to cause service failures...
GHSA-HQR4-QQ8F-HG3X stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk
Summary The JSONC parser stream-json/jsonc/parser.js and verifier stream-json/jsonc/verifier.js scan a comment for its terminator starting from the comment's opening / on every input chunk. When a comment doesn't finish inside the current buffer, the scanner returns the comment's start offset and...
NPM: stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk
NPM: stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk vulnerability discovered by ? in WordPress Npm stream-json versions = 3.5.0...
EUVD-2026-91056
stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk...
stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk
Summary The JSONC parser stream-json/jsonc/parser.js and verifier stream-json/jsonc/verifier.js scan a comment for its terminator starting from the comment's opening / on every input chunk. When a comment doesn't finish inside the current buffer, the scanner returns the comment's start offset and...
stream-json has a prototype pollution issue: Assembler writes this.current[this.key] on plain objects
Summary A prototype-pollution vulnerability in stream-json lets attacker-controlled JSON replace a parsed object's prototype. Details The streaming JSON parser StreamValues/StreamObject/jsonc variants writes keys via plain assignment, so a proto key replaces the parsed object's prototype with...
CVE-2026-104182
A flaw was found in stream-json. A local attacker can cause a Denial of Service DoS by providing JSON with Comments JSONC input containing large comments split across multiple small chunks. The parser repeatedly rescans accumulated comment data from the beginning for each chunk, leading to...
CVE-2026-104182
stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, the JSONC parser at stream-json/jsonc/parser.js and verifier at stream-json/jsonc/verifier.js restart comment-terminator scanning from the opening slash whenever a...
CVE-2026-104183
stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, Assembler materializes object properties with plain assignment, so an input key named proto invokes the inherited setter and causes parsed object prototype replacemen...
CVE-2026-104182 stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk
stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, the JSONC parser at stream-json/jsonc/parser.js and verifier at stream-json/jsonc/verifier.js restart comment-terminator scanning from the opening slash whenever a...
CVE-2026-104182
The stream-json micro-library is vulnerable to a Denial of Service (DoS) via a flaw in its JSONC parser (specifically at stream-json/jsonc/parser.js and stream-json/jsonc/verifier.js). Prior to version 3.6.0 , the parser restarts comment-terminator scanning from the opening slash whenever a block...
CVE-2026-104182 stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk
stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, the JSONC parser at stream-json/jsonc/parser.js and verifier at stream-json/jsonc/verifier.js restart comment-terminator scanning from the opening slash whenever a...
CVE-2026-104182 stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk
stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, the JSONC parser at stream-json/jsonc/parser.js and verifier at stream-json/jsonc/verifier.js restart comment-terminator scanning from the opening slash whenever a...
CVE-2026-104182
stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, the JSONC parser at stream-json/jsonc/parser.js and verifier at stream-json/jsonc/verifier.js restart comment-terminator scanning from the opening slash whenever a...
CVE-2026-104182: Inefficient Algorithmic Complexity
stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, the JSONC parser at stream-json/jsonc/parser.js and verifier at stream-json/jsonc/verifier.js restart comment-terminator scanning from the opening slash whenever a...
PT-2026-104010
Name of the Vulnerable Software and Affected Versions stream-json versions prior to 3.6.0 Description The JSONC parser at stream-json/jsonc/parser.js and verifier at stream-json/jsonc/verifier.js restart comment-terminator scanning from the opening slash when a block or line comment spans an inpu...
RUSTSEC-2025-0120 json5 crate is unmaintained
The json5 crate is no longer actively maintained. If you rely on this crate, consider switching to a recommended alternative. Recommended alternatives - serdejson5 - jsonc-parser - json-five...
json5 crate is unmaintained
The json5 crate is no longer actively maintained. If you rely on this crate, consider switching to a recommended alternative. Recommended alternatives - serdejson5 - jsonc-parser - json-five...
WordPress TopBar plugin <= 1.0.0 - Cross-Site Request Forgery to Settings Update vulnerability
Cross-Site Request Forgery to Settings Update vulnerability discovered by jsonc in WordPress Plugin TopBar versions = 1.0.0...
