stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service

Summary FlexAssembler, the custom-container assembler shipped in the stream-json package src/core/utils/flex-assembler.js, re-exported at stream-json/utils/flex-assembler.js and stream-json/web/utils/flex-assembler.js, compiles a string or RegExp path filter into a matcher that runs...

GHSA-JJ87-HC4R-JWFW stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service

Summary FlexAssembler, the custom-container assembler shipped in the stream-json package src/core/utils/flex-assembler.js, re-exported at stream-json/utils/flex-assembler.js and stream-json/web/utils/flex-assembler.js, compiles a string or RegExp path filter into a matcher that runs...