{"id":"ghsa-ghsa-jj87-hc4r-jwfw","seq":309601,"kind":"advisory","title":"stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service","url":"https://github.com/advisories/GHSA-jj87-hc4r-jwfw","permalink":"https://vulnpulse.app/items/ghsa-ghsa-jj87-hc4r-jwfw","summary":"影響: npm:stream-json >= 2.0.0, <= 3.6.0 → 3.7.0\nFlexAssembler, the custom-container assembler shipped in the stream-json package (src/core/utils/flex-assembler.js, re-exported at stream-json/utils/flex-assembler.js and stream-json/web/utils/flex-assembler.js), compiles a string or RegExp path filter into a matcher that runs keyStack.join(separator) on every container start. Because the key stack grows one entry per open object or array with no depth bound, a JSON document nested to depth D drives D container-start tokens that each perform an…","severity":"medium","techs":["nodejs"],"cves":["CVE-2026-114129"],"tags":["GHSA-jj87-hc4r-jwfw","stream-json"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-22T15:49:54.000Z","fetched_at":"2026-10-22T20:09:55.169Z"}