stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service
影響: npm:stream-json >= 2.0.0, <= 3.6.0 → 3.7.0
FlexAssembler, the custom-container assembler shipped in the stream-json package (src/core/utils/flex-assembler.js, re-exported at stream-json/utils/flex-assembler.js and stream-json/web/utils/flex-assembler.js), compiles a string or RegExp path filter into a matcher that runs keyStack.join(separator) on every container start. Because the key stack grows one entry per open object or array with no depth bound, a JSON document nested to depth D drives D container-start tokens that each perform an…
Read on GitHub Advisory Database
| CVE | CVE-2026-114129 |
|---|---|
| Source | GitHub Advisory Database |
| Fetched | 10/23/2026, 05:09 AM |
| Data | Markdown JSON |
On 10/23/2026, 12:49 AM, GitHub Advisory Database published "stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service" (type: Advisory). Severity is "Medium" (medium). Related technologies: JavaScript / Node.js. CVE: CVE-2026-114129.