CLEANSTART-2026-ME44446 stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint

Security vulnerability affects the n8n package. stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint...

CLEANSTART-2026-EJ44011 stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint

Security vulnerability affects the n8n package. stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint...

CLEANSTART-2026-AK31970 stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint

Security vulnerability affects the n8n package. stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint...

CLSA-2026-1791278816 TuxCare security update for stream-json (1 CVE)

TuxCare rebuilt stream-json to address 1 CVE. Fixed in 1.9.1-tuxcare.8...

The vulnerabilities in the `stream-json/jsonc/parser.js` and `stream-json/jsonc/verifier.js` libraries for processing JSON and JSONC streams allow attackers to induce service failures.

The vulnerability in the stream-json/jsonc/parser.js and stream-json/jsonc/verifier.js libraries for processing JSON and JSONC streams is related to inefficient algorithmic complexity. Exploiting this vulnerability can allow attackers to cause service failures...

The vulnerability of the JSON processing library and stream-json, related to inadequate control over changes to prototype attributes, allows attackers to execute a “prototype pollution” attack.

The vulnerability of the JSON processing library and stream-json is related to inadequate control over changes to prototype attributes. Exploiting this vulnerability could allow an attacker to execute a “prototype pollution” attack...

EUVD-2026-91056

stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk...

NPM: stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk

NPM: stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk vulnerability discovered by ? in WordPress Npm stream-json versions = 3.5.0...

stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk

Summary The JSONC parser stream-json/jsonc/parser.js and verifier stream-json/jsonc/verifier.js scan a comment for its terminator starting from the comment's opening / on every input chunk. When a comment doesn't finish inside the current buffer, the scanner returns the comment's start offset and...

GHSA-HQR4-QQ8F-HG3X stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk

Summary The JSONC parser stream-json/jsonc/parser.js and verifier stream-json/jsonc/verifier.js scan a comment for its terminator starting from the comment's opening / on every input chunk. When a comment doesn't finish inside the current buffer, the scanner returns the comment's start offset and...

NPM: stream-json has a prototype pollution issue: Assembler writes this.current[this.key] on plain objects

NPM: stream-json has a prototype pollution issue: Assembler writes this.currentthis.key on plain objects vulnerability discovered by ? in WordPress Npm stream-json versions 3.6.0...

stream-json has a prototype pollution issue: Assembler writes this.current[this.key] on plain objects

Summary A prototype-pollution vulnerability in stream-json lets attacker-controlled JSON replace a parsed object's prototype. Details The streaming JSON parser StreamValues/StreamObject/jsonc variants writes keys via plain assignment, so a proto key replaces the parsed object's prototype with...

EUVD-2026-91057

stream-json has a prototype pollution issue: Assembler writes this.currentthis.key on plain objects...

authowl (>=0.3.0, <=0.3.12), quicktype (>=26.0.0-pre1, <=26.0.0) +1 more potentially affected by CVE-2026-104183 via stream-json (3.5.0)

stream-json NPM version 3.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on stream-json and may be impacted: - authowl =0.3.0, =26.0.0-pre1, =0.1.0, =0.1.1 Source cves: CVE-2026-104183 Source advisory: OSV:GHSA-MJW6-4JJ6-33HC...

GHSA-MJW6-4JJ6-33HC stream-json has a prototype pollution issue: Assembler writes this.current[this.key] on plain objects

Summary A prototype-pollution vulnerability in stream-json lets attacker-controlled JSON replace a parsed object's prototype. Details The streaming JSON parser StreamValues/StreamObject/jsonc variants writes keys via plain assignment, so a proto key replaces the parsed object's prototype with...

CVE-2026-104183

A flaw was found in stream-json. When parsing JSON data, the Assembler component directly assigns properties, allowing an input key named 'proto' to replace a parsed object's internal prototype rather than creating a standard property. An attacker who supplies crafted input can exploit this...

CVE-2026-104182

A flaw was found in stream-json. A local attacker can cause a Denial of Service DoS by providing JSON with Comments JSONC input containing large comments split across multiple small chunks. The parser repeatedly rescans accumulated comment data from the beginning for each chunk, leading to...

CVE-2026-104182

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, the JSONC parser at stream-json/jsonc/parser.js and verifier at stream-json/jsonc/verifier.js restart comment-terminator scanning from the opening slash whenever a...

CVE-2026-104183

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, Assembler materializes object properties with plain assignment, so an input key named proto invokes the inherited setter and causes parsed object prototype replacemen...

CVE-2026-104183 stream-json: Prototype pollution: Assembler writes this.current[this.key] on plain objects

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, Assembler materializes object properties with plain assignment, so an input key named proto invokes the inherited setter and causes parsed object prototype replacemen...