Skip to main content
cve.nowby Sazabi
← npm
npmPackage

stream-json

4 known vulnerabilities (4 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
4 · 4 medium
Registry
npm

Advisories 4

  • CVE-2026-114129Medium 6.2

    stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service

    Affected: from 2.0.0, fixed in 3.7.0.

  • CVE-2026-104183Medium 5.1

    stream-json: Prototype pollution: Assembler writes this.current[this.key] on plain objects

    Affected: fixed in 3.6.0.

  • CVE-2026-104182Medium 6.2

    stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk

    Affected: fixed in 3.6.0.

  • CVE-2026-71429Medium 6.2

    stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for…

    Affected: fixed in 3.5.0.