Description
FlexAssembler, the custom-container assembler shipped in the stream-json package (src/core/utils/flex-assembler.js, re-exported at stream-json/utils/flex-assembler.js and stream-json/web/utils/flex-assembler.js), compiles a string or RegExp path filter into a matcher that runs keyStack.join(separator) on every container start.
Recommendation
Update the stream-json package to the latest compatible version. Followings are version details:
- Affected version(s): >= 2.0.0, <= 3.6.0
- Patched version(s): 3.7.0
References
Could your website be exposed too?
SmartScanner can check your website for stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU and gives you actionable findings to investigate.
Start a free scanRelated Issues
- stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop - CVE-2026-71429
- stream-json has a prototype pollution issue: Assembler writes this.current[this.key] on plain objects - CVE-2026-104183
- stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk - CVE-2026-104182
- Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in `JSONPathBuilder.key()` / `.at()` - CVE-2026-44635
You might also like:
See something that needs correcting? Let us knowUpdated October 22, 2026