Description
The path filters pick, ignore, filter, and replace — the library’s headline “surgical extraction” feature — recompute the full path string from the nesting stack on every checkable token.
Recommendation
Update the stream-json package to the latest compatible version. Followings are version details:
- Affected version(s): <= 3.4.0
- Patched version(s): 3.5.0
References
Could your website be exposed too?
SmartScanner can check your website for stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop and gives you actionable findings to investigate.
Start a free scanRelated Issues
- stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU - CVE-2026-114129
- stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk - CVE-2026-104182
- stream-json has a prototype pollution issue: Assembler writes this.current[this.key] on plain objects - CVE-2026-104183
- msgpack5: Deeply nested input can exhaust the decoder stack - CVE-2026-107298
You might also like:
See something that needs correcting? Let us knowUpdated September 03, 2026