CVE-2026-71429

A flaw was found in stream-json. This vulnerability allows a remote attacker to cause a Denial of Service DoS by providing a specially crafted, deeply nested JSON document. The library's path filters, such as pick and ignore, inefficiently process these structures, leading to excessive resource...

CVE-2026-85063

node-csv (csv-parse) versions prior to 7.0.2 are vulnerable to a prototype replacement issue when the columns and group_columns_by_name options are enabled. In packages/csv-parse/lib/api/index.js, a duplicate __proto__ header in a CSV file is treated as an existing property, allowing an attacker-...

CVE-2026-85063 node-csv: Prototype replacement still reachable via columns path

node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and groupcolumnsbyname options enabled treats a duplicate proto header as an existing property in packages/csv-parse/lib/api/index.js, assigns an...

CVE-2026-85063 node-csv: Prototype replacement still reachable via columns path

node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and groupcolumnsbyname options enabled treats a duplicate proto header as an existing property in packages/csv-parse/lib/api/index.js, assigns an...

GHSA-528H-PC64-C93X stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)

Description The path filters pick, ignore, filter, and replace — the library's headline "surgical extraction" feature — recompute the full path string from the nesting stack on every checkable token. Because the stack length equals the current nesting depth, and a checkable token is emitted at...

NPM: stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)

NPM: stream-json: pick/ignore/filter/replace filters are Odepth² on nested input — small crafted JSON blocks the event loop for seconds→minutes DoS vulnerability discovered by ? in WordPress Npm stream-json versions = 3.4.0...

stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)

Description The path filters pick, ignore, filter, and replace — the library's headline "surgical extraction" feature — recompute the full path string from the nesting stack on every checkable token. Because the stack length equals the current nesting depth, and a checkable token is emitted at...

CVE-2026-71429

stream-json , a micro-library for streaming JSON/JSONC processing, has a denial-of-service vulnerability in its path filters (pick, ignore, filter, replace) defined in src/core/filters/filter-base.js. Prior to 3.5.0 , these filters recompute the full path string from the nesting stack for every c...

CVE-2026-71429 stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.5.0, the path filters pick, ignore, filter, and replace in src/core/filters/filter-base.js recompute the full path string from the nesting stack for every checkable token...

CVE-2026-71429 stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.5.0, the path filters pick, ignore, filter, and replace in src/core/filters/filter-base.js recompute the full path string from the nesting stack for every checkable token...

CVE-2026-71429 stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.5.0, the path filters pick, ignore, filter, and replace in src/core/filters/filter-base.js recompute the full path string from the nesting stack for every checkable token...

EUVD-2026-70733

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.5.0, the path filters pick, ignore, filter, and replace in src/core/filters/filter-base.js recompute the full path string from the nesting stack for every checkable token...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write in the BSON-to-JSON conversion process when a binary field is encoded and the output is truncated at a specified length limit. An attacker can alter a small amount of data outside the intended buffer by supplying...

Incorrect Conversion between Numeric Types

Overview Affected versions of this package are vulnerable to Incorrect Conversion between Numeric Types in the JSON parsing process. An attacker can cause the library to read memory beyond the supplied buffer, return unintended data to the caller, or terminate the process by supplying a very larg...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound via the JSON parsing process. An attacker can cause the application to terminate unexpectedly by supplying a specially crafted large JSON input, leading to memory corruption and potential denial of service...

CVE-2026-85239

A vulnerability in MISP's event template handling allowed an authenticated user with permission to create or modify event templates to bypass validation of the template definition field. The EventTemplate::beforeValidate method only performed semantic validation when the supplied definition was...

CVE-2026-84965

An integer wraparound in an allocation size calculation in the BSON library's JSON parsing code can cause a buffer to be released while a following copy operation still writes through the stale pointer. On builds where sizes are 32 bits, an unauthenticated party able to supply a sufficiently larg...

DEBIAN-CVE-2026-84963

An incorrect numeric conversion in the JSON parsing component of the MongoDB C Driver's BSON library may cause an unusually large text value to be silently shortened, or the corresponding field to be omitted, while the parsing operation still reports success and returns no error. An unauthenticat...

CVE-2026-84963

An incorrect numeric conversion in the JSON parsing component of the MongoDB C Driver's BSON library may cause an unusually large text value to be silently shortened, or the corresponding field to be omitted, while the parsing operation still reports success and returns no error. An unauthenticat...

DEBIAN-CVE-2026-84965

An integer wraparound in an allocation size calculation in the BSON library's JSON parsing code can cause a buffer to be released while a following copy operation still writes through the stale pointer. On builds where sizes are 32 bits, an unauthenticated party able to supply a sufficiently larg...