stream-json has a prototype pollution issue: Assembler writes this.current[this.key] on plain objects

Description

A prototype-pollution vulnerability in stream-json lets attacker-controlled JSON replace a parsed object’s prototype.

Recommendation

Update the stream-json package to the latest compatible version. Followings are version details:

Affected version(s): < 3.6.0
Patched version(s): 3.6.0

References

GHSA-mjw6-4jj6-33hc
CVE-2026-104183
CWE-1321
CAPEC-310

Could your website be exposed too?

SmartScanner can check your website for stream-json has a prototype pollution issue: Assembler writes this.current[this.key] on plain objects and gives you actionable findings to investigate.

Start a free scan

Related Issues

@rvf/set-get has a prototype pollution issue that's reachable via @rvf/core preprocessFormData (HTTP form data) - CVE-2026-44483
@phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging - CVE-2026-54737
stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU - CVE-2026-114129
Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking - CVE-2026-42264

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

See something that needs correcting? Let us knowUpdated October 05, 2026