Read the docs
TI-2026-78913 Aliases CVE-2026-114129GHSA-jj87-hc4r-jwfw

Quadratic CPU use in stream-json FlexAssembler allows denial of service

Priority MEDIUM 61CWE-407Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-407.

Summary

stream-json from 2.0.0 before 3.7.0 has FlexAssembler string and regular-expression path filters that join the full key stack on every container start (CWE-407). Deeply nested documents cause quadratic CPU use on the single-threaded event loop. An unauthenticated attacker can stall all concurrent work in a process by sending a crafted nested document to an affected FlexAssembler. CISA SSVC rates exploitation as proof of concept.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. From 2.0.0 until 3.7.0, FlexAssembler compiles string and regular-expression path filters into matchers that join the full key stack on every container start. Because the key stack grows with unbounded object or array nesting, a document nested to depth D causes D joins whose cost grows with the current depth, resulting in quadratic CPU consumption on the single-threaded event loop. The join occurs before the rule match decision, so the attacker does not need to know the target schema. Consumers using only function filters or no rules are not affected. A crafted nested document can stall all concurrent work in a process that feeds it to an affected FlexAssembler. This issue is fixed in 3.7.0, which adds a default maximum depth.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00254 17th percentileScored 2026-11-07
Fix Partial stream-json (uhop): 3.7.0stream-json (npm): 3.7.0Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
uhopstream-json2.0.0 to before 3.7.03.7.0Patch availableCNA
—stream-json (npm)2.0.0 to before 3.7.03.7.0Patch availableGHSA-jj87-hc4r-jwfw
  • stream-json Vendoruhop Affected 2.0.0 to before 3.7.0 Fixed in 3.7.0 Patch available CNA
  • stream-json (npm) Vendor— Affected 2.0.0 to before 3.7.0 Fixed in 3.7.0 Patch available GHSA-jj87-hc4r-jwfw

Remediation

Upgrade stream-json to 3.7.0, which adds a default maximum depth. Red Hat lists the Red Hat Build of Podman Desktop as affected with no fix available.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA stream-json (uhop) Fixed in 3.7.0
  • Fix · GHSA-jj87-hc4r-jwfw stream-json (npm) Fixed in 3.7.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Build of Podman DesktopAffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-21 Threatist record created from CVE-2026-114129
  2. 2026-10-22 Affected versions changed · Red Hat
  3. 2026-10-22 CVSS score added · Red Hat
  4. 2026-10-22 Alias added: GHSA-jj87-hc4r-jwfw
  5. 2026-10-22 Fix available: npm/[email protected] · GHSA-jj87-hc4r-jwfw
  6. 2026-10-22 CVSS score added · GHSA-jj87-hc4r-jwfw
  7. 2026-10-22 Weakness changed · GHSA-jj87-hc4r-jwfw
  8. 2026-10-22 6 new references · GHSA-jj87-hc4r-jwfw
  9. 2026-10-23 Priority changed: MEDIUM → LOW
  10. 2026-10-28 CISA SSVC decision points changed
  11. 2026-10-28 Priority changed: LOW → MEDIUM

References

Advisory 1

Other 5

  • TI-2026-65777 stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk CVSS 3.1MEDIUM 6.2
  • TI-2026-50052 Reachable assertion in uhop node-re2 CVSS 3.1MEDIUM 6.2
  • TI-2026-50051 stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small… CVSS 3.1MEDIUM 6.2
  • TI-2026-48273 Infinite loop in uhop node-re2 CVSS 3.1MEDIUM 6.2
  • TI-2026-47734 Out-of-bounds read in uhop node-re2 CVSS 3.1MEDIUM 5.7
  • TI-2026-65778 stream-json: Prototype pollution: Assembler writes this.current[this.key] on plain objects CVSS 3.1MEDIUM 5.1
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences