77 matches found
CVE-2026-104182
A flaw was found in stream-json. A local attacker can cause a Denial of Service DoS by providing JSON with Comments JSONC input containing large comments split across multiple small chunks. The parser repeatedly rescans accumulated comment data from the beginning for each chunk, leading to...
CVE-2026-104182
stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, the JSONC parser at stream-json/jsonc/parser.js and verifier at stream-json/jsonc/verifier.js restart comment-terminator scanning from the opening slash whenever a...
CVE-2026-104183
stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, Assembler materializes object properties with plain assignment, so an input key named proto invokes the inherited setter and causes parsed object prototype replacemen...
CVE-2026-104183
stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, Assembler materializes object properties with plain assignment, so an input key named proto invokes the inherited setter and causes parsed object prototype replacemen...
CVE-2026-104183 stream-json: Prototype pollution: Assembler writes this.current[this.key] on plain objects
stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, Assembler materializes object properties with plain assignment, so an input key named proto invokes the inherited setter and causes parsed object prototype replacemen...
CVE-2026-104183 stream-json: Prototype pollution: Assembler writes this.current[this.key] on plain objects
stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, Assembler materializes object properties with plain assignment, so an input key named proto invokes the inherited setter and causes parsed object prototype replacemen...
CVE-2026-104183
The stream-json micro-library (versions prior to 3.6.0 ) is vulnerable to a prototype pollution flaw within its Assembler component. The root cause is the use of plain assignment to materialize object properties, which allows an input key named __proto__ to invoke an inherited setter. This result...
CVE-2026-104183 stream-json: Prototype pollution: Assembler writes this.current[this.key] on plain objects
stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, Assembler materializes object properties with plain assignment, so an input key named proto invokes the inherited setter and causes parsed object prototype replacemen...
0beny1s (1.1.6), 0x404 (1.1.4) +14306 more potentially affected by CVE-2026-104183 via stream-json (>=0.4.2, <=3.5.0)
stream-json NPM version =0.4.2, =0.0.2, =0.0.7, =0.0.0-20251106131028, =0.0.2, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.10 and more Source cves: CVE-2026-104183 Source advisory: MEND:CVE-2026-104183...
CVE-2026-104182
stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, the JSONC parser at stream-json/jsonc/parser.js and verifier at stream-json/jsonc/verifier.js restart comment-terminator scanning from the opening slash whenever a...
CVE-2026-104182
The stream-json micro-library is vulnerable to a Denial of Service (DoS) via a flaw in its JSONC parser (specifically at stream-json/jsonc/parser.js and stream-json/jsonc/verifier.js). Prior to version 3.6.0 , the parser restarts comment-terminator scanning from the opening slash whenever a block...
CVE-2026-104182 stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk
stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, the JSONC parser at stream-json/jsonc/parser.js and verifier at stream-json/jsonc/verifier.js restart comment-terminator scanning from the opening slash whenever a...
CVE-2026-104182 stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk
stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, the JSONC parser at stream-json/jsonc/parser.js and verifier at stream-json/jsonc/verifier.js restart comment-terminator scanning from the opening slash whenever a...
CVE-2026-104182 stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk
stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, the JSONC parser at stream-json/jsonc/parser.js and verifier at stream-json/jsonc/verifier.js restart comment-terminator scanning from the opening slash whenever a...
0beny1s (1.1.6), 0x404 (1.1.4) +14306 more potentially affected by CVE-2026-104182 via stream-json (>=0.4.2, <=3.5.0)
stream-json NPM version =0.4.2, =0.0.2, =0.0.7, =0.0.0-20251106131028, =0.0.2, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.10 and more Source cves: CVE-2026-104182 Source advisory: MEND:CVE-2026-104182...
CVE-2026-104183: Improperly Controlled Modification of Object Prototype Attributes
stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, Assembler materializes object properties with plain assignment, so an input key named proto invokes the inherited setter and causes parsed object prototype replacemen...
CVE-2026-104182: Inefficient Algorithmic Complexity
stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, the JSONC parser at stream-json/jsonc/parser.js and verifier at stream-json/jsonc/verifier.js restart comment-terminator scanning from the opening slash whenever a...
CLSA-2026-1790541875 TuxCare security update for stream-json (1 CVE)
TuxCare rebuilt stream-json to address 1 CVE. Fixed in 1.9.1-tuxcare.1...
PT-2026-107729
TuxCare rebuilt stream-json to address 1 CVE. Fixed in 1.9.1-tuxcare.1...
JSON Processing Algorithmic Complexity DoS
The vulnerability of the JSON processing library and stream-json is related to algorithmic complexity. Exploiting this vulnerability could allow an attacker to cause a service failure...