p PatchFirst

PatchFirst · Vulnérabilités récentes

Vulnérabilités de stream-json

Vulnérabilités publiées pour stream-json au cours des 30 derniers jours : 3. Présentes dans le catalogue KEV : 0.

RSS ↗
Filtrer les vulnérabilités
Effacer les filtres

Vulnérabilités : 4

  1. CVE-2026-114129

    Moyenne · CVSS 6.2EPSS 0,14%Correctif disponible

    stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service

    stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. From 2.0.0 until 3.7.0, FlexAssembler compiles string and regular-expression path filters into matchers that join the full key stack on every container start. Because the key stack grows with unbounded object or array nesting, a document nested to depth D causes D joins whose cost grows with the current depth, resulting in quadratic CPU consumption on the single-threaded event loop. The join occurs before the rule match decision, so the attacker does not need to know the target schema. Consumers using only function filters or no

    stream-jsonNode.js
    • Mettez à jour vers 3.7.0
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  2. CVE-2026-104183

    Moyenne · CVSS 5.1EPSS 0,19%Correctif disponible

    stream-json: Prototype pollution: Assembler writes this.current[this.key] on plain objects

    stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, Assembler materializes object properties with plain assignment, so an input key named __proto__ invokes the inherited setter and causes parsed object prototype replacement instead of creating an own data property. Applications that make authorization or feature decisions from inherited values can therefore consume attacker-controlled properties, and a null prototype can disrupt code that expects Object.prototype methods. The researcher treats parsing untrusted JSON as part of the project contract, while the mainta

    stream-jsonNode.js
    • Mettez à jour vers 3.6.0
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  3. CVE-2026-104182

    Moyenne · CVSS 6.2EPSS 0,14%Correctif disponible

    stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk

    stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, the JSONC parser at stream-json/jsonc/parser.js and verifier at stream-json/jsonc/verifier.js restart comment-terminator scanning from the opening slash whenever a block or line comment spans an input chunk, while retaining the accumulated comment buffer. Delivering a large valid comment across many small chunks therefore causes quadratic CPU work and can stall the Node.js event loop. The maintainer characterizes the attack vector as local because the documented JSONC input is locally owned or user-controlled conf

    stream-jsonNode.js
    • Mettez à jour vers 3.6.0
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  4. CVE-2026-71429

    Moyenne · CVSS 6.2EPSS 0,16%Correctif disponible

    stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)

    stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.5.0, the path filters pick, ignore, filter, and replace in src/core/filters/filter-base.js recompute the full path string from the nesting stack for every checkable token. Because the stack length equals the current nesting depth and a checkable token is emitted at every level, a depth D document costs O(D²) rather than O(D) to process. The issue is triggered by nesting depth rather than byte volume, including the documented pick({filter: 'data'}) traversal-until-match path, so an application that sends untrusted JSON

    stream-jsonNode.js
    • Mettez à jour vers 3.5.0
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

Vérifiez votre serveur

Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.

Vérifiez votre serveur →