Read the docs
TI-2026-50051 Aliases CVE-2026-71429GHSA-528h-pc64-c93x

stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small…

Priority MEDIUM 61CWE-407Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-407.

Summary

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.5.0, the path filters pick, ignore, filter, and replace in src/core/filters/filter-base.js recompute the full path string from the nesting stack for every checkable token. Because the stack length equals the current nesting depth and a checkable token is emitted at every level, a depth D document costs O(D²) rather than O(D) to process. The issue is triggered by nesting depth rather than byte volume, including the documented pick({filter: 'data'}) traversal-until-match path, so an application that sends untrusted JSON through a string or RegExp filter can block the Node.js event loop and cause denial of service with a small deeply nested document. The streamArray, streamObject, and streamValues streamers are not affected because they use the constant-time asm.depth getter. This issue is fixed in version 3.5.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0016 5th percentileScored 2026-11-07
Fix Partial stream-json (uhop): 3.5.0stream-json (npm): 3.5.0Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
uhopstream-jsonbefore 3.5.03.5.0Patch availableCNA
—stream-json (npm)before 3.5.03.5.0Patch availableGHSA-528h-pc64-c93x
  • stream-json Vendoruhop Affected before 3.5.0 Fixed in 3.5.0 Patch available CNA
  • stream-json (npm) Vendor— Affected before 3.5.0 Fixed in 3.5.0 Patch available GHSA-528h-pc64-c93x

Remediation

  • Fix · CNA stream-json (uhop) Fixed in 3.5.0
  • Fix · GHSA-528h-pc64-c93x stream-json (npm) Fixed in 3.5.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Build of Podman DesktopAffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-71429
  2. 2026-10-03 Alias added: GHSA-528h-pc64-c93x

References

Other 3

  • TI-2026-78913 Quadratic CPU use in stream-json FlexAssembler allows denial of service CVSS 3.1MEDIUM 6.2
  • TI-2026-65777 stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk CVSS 3.1MEDIUM 6.2
  • TI-2026-50052 Reachable assertion in uhop node-re2 CVSS 3.1MEDIUM 6.2
  • TI-2026-48273 Infinite loop in uhop node-re2 CVSS 3.1MEDIUM 6.2
  • TI-2026-47734 Out-of-bounds read in uhop node-re2 CVSS 3.1MEDIUM 5.7
  • TI-2026-65778 stream-json: Prototype pollution: Assembler writes this.current[this.key] on plain objects CVSS 3.1MEDIUM 5.1
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences