Description
The JSONC parser (stream-json/jsonc/parser.js) and verifier (stream-json/jsonc/verifier.js) scan a comment for its terminator starting from the comment’s opening / on every input chunk.
Recommendation
Update the stream-json package to the latest compatible version. Followings are version details:
- Affected version(s): <= 3.5.0
- Patched version(s): 3.6.0
References
Could your website be exposed too?
SmartScanner can check your website for stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk and gives you actionable findings to investigate.
Start a free scanRelated Issues
- stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop - CVE-2026-71429
- stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU - CVE-2026-114129
- stream-json has a prototype pollution issue: Assembler writes this.current[this.key] on plain objects - CVE-2026-104183
- xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` - xmldom - CVE-2026-83614
You might also like:
See something that needs correcting? Let us knowUpdated October 05, 2026