Stream-json: FlexAssembler String/RegExp Path Filters Join The Full Key Stack Per Container Start, Giving O(depth^2) CPU

Summary "FlexAssembler", the custom-container assembler shipped in the "stream-json" package "src/core/utils/flex-assembler.js", re-exported at "stream-json/utils/flex-assembler.js" and "stream-json/web/utils/flex-assembler.js", compiles a string or RegExp path "filter" into a matcher that runs...

stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service

Summary FlexAssembler, the custom-container assembler shipped in the stream-json package src/core/utils/flex-assembler.js, re-exported at stream-json/utils/flex-assembler.js and stream-json/web/utils/flex-assembler.js, compiles a string or RegExp path filter into a matcher that runs...

GHSA-JJ87-HC4R-JWFW stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service

Summary FlexAssembler, the custom-container assembler shipped in the stream-json package src/core/utils/flex-assembler.js, re-exported at stream-json/utils/flex-assembler.js and stream-json/web/utils/flex-assembler.js, compiles a string or RegExp path filter into a matcher that runs...

npm: stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service

npm: stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving Odepth^2 CPU denial of service vulnerability discovered by ? in WordPress npm stream-json versions = 2.0.0, = 3.6.0...

@absterrg0/circe (0.0.52), @adithyasak/t3 (>=0.0.39-adi.1, <=0.1.5-adi.1) +52 more potentially affected by CVE-2026-114129 via stream-json (>=2.0.0, <=3.6.0)

stream-json NPM version =2.0.0, =0.0.39-adi.1, =0.0.40, =0.28.5-next.1.g1cbb93286, =0.0.37-nightly.20260907.52, =12.4.0-depup.0, =39.2.0, =0.0.40-synaptic.1, =0.1.16, =0.0.41-nightly.20260909.69, =0.0.47 - @iflow-mcp/dcostenco-prism-mcp-server 6.2.2 - @jacksondr5/j5code 0.0.43 -...

@absterrg0/circe (0.0.52), @adithyasak/t3 (>=0.0.39-adi.1, <=0.1.5-adi.1) +52 more potentially affected by CVE-2026-114129 via stream-json (>=2.0.0, <=3.6.0)

stream-json NPM version =2.0.0, =0.0.39-adi.1, =0.0.40, =0.28.5-next.1.g1cbb93286, =0.0.37-nightly.20260907.52, =12.4.0-depup.0, =39.2.0, =0.0.40-synaptic.1, =0.1.16, =0.0.41-nightly.20260909.69, =0.0.47 - @iflow-mcp/dcostenco-prism-mcp-server 6.2.2 - @jacksondr5/j5code 0.0.43 -...

EUVD-2026-107412

stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving Odepth^2 CPU denial of service...

CVE-2026-114129

A flaw was found in stream-json. The FlexAssembler component does not enforce a limit on nesting depth when processing JSON documents configured with path filters. By submitting a crafted document with deeply nested objects or arrays, an attacker can trigger excessive key operations that consume...

CVE-2026-114129

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. From 2.0.0 until 3.7.0, FlexAssembler compiles string and regular-expression path filters into matchers that join the full key stack on every container start. Because the key stack...

CVE-2026-114129 stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. From 2.0.0 until 3.7.0, FlexAssembler compiles string and regular-expression path filters into matchers that join the full key stack on every container start. Because the key stack...

CVE-2026-114129

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. From 2.0.0 until 3.7.0, FlexAssembler compiles string and regular-expression path filters into matchers that join the full key stack on every container start. Because the key stack...

CVE-2026-114129 stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. From 2.0.0 until 3.7.0, FlexAssembler compiles string and regular-expression path filters into matchers that join the full key stack on every container start. Because the key stack...

@absterrg0/circe (0.0.52), @adithyasak/t3 (>=0.0.39-adi.1, <=0.1.5-adi.1) +31 more potentially affected by CVE-2026-114129 via stream-json (>=3.5.0, <=3.6.0)

stream-json NPM version =3.5.0, =0.0.39-adi.1, =0.0.40, =0.28.5-next.1.g1cbb93286, =0.0.37-nightly.20260907.52, =12.4.0-depup.0, =39.2.0, =0.0.40-synaptic.1, =0.1.16, =0.0.41-nightly.20260909.69, =0.0.43-nightly.20260911.744, =0.0.41, =0.0.52-edge.38659523309.1, =0.0.52-edge.41165096709.1 and mor...

CVE-2026-114129

The stream-json micro-library (versions 2.0.0 through 3.7.0 ) is vulnerable to a CPU denial of service due to inefficient algorithmic complexity in the FlexAssembler component. When processing string or regular-expression path filters, the library joins the full key stack on every container start...

CVE-2026-114129 stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. From 2.0.0 until 3.7.0, FlexAssembler compiles string and regular-expression path filters into matchers that join the full key stack on every container start. Because the key stack...

Eugene Lazutkin stream-json resource management error vulnerability

Versions 2.0.0 through 3.7.0 of Stream-JSON contain a resource management error vulnerability. This vulnerability arises because the path filter matcher in FlexAssembler connects the full key stack at the start of each container. As the key stack grows indefinitely with nested objects or arrays, ...

PT-2026-120732

Name of the Vulnerable Software and Affected Versions stream-json versions 2.0.0 through 3.6.9 Description FlexAssembler compiles string and regular-expression path filters into matchers that join the full key stack on every container start. Due to unbounded object or array nesting, a document...

CLEANSTART-2026-AK31970 stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint

Security vulnerability affects the n8n package. stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint...

CLEANSTART-2026-ME44446 stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint

Security vulnerability affects the n8n package. stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint...

CLEANSTART-2026-EJ44011 stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint

Security vulnerability affects the n8n package. stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint...