---
id: CVE-2026-71429
title: >-
  stream-json is a micro-library of stream components for processing JSON and
  JSONC with a minimal memory footprint
summary: >-
  stream-json is a micro-library of stream components for processing JSON and
  JSONC with a minimal memory footprint. Prior to 3.5.0, the path filters pick,
  ignore, filter, and replace in src/core/filters/filter-base.js recompute the
  full p…
severity: medium
cvss: 6.2
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-407
vendor: stream-json
product: stream-json
affected:
  - stream-json <= 3.4.0
patched:
  - stream-json 3.5.0
published: '2026-09-03'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:09:13.080'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-71429'
references:
  - url: >-
      https://github.com/uhop/stream-json/commit/a869fb98aaef9225556f49901a8f55954ff856e6
    label: security-advisories@github.com
  - url: >-
      https://github.com/uhop/stream-json/security/advisories/GHSA-528h-pc64-c93x
    label: security-advisories@github.com
  - url: >-
      https://github.com/uhop/stream-json/security/advisories/GHSA-528h-pc64-c93x
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://github.com/advisories/GHSA-528h-pc64-c93x'
tags:
  - nvd
  - ghsa
  - npm
epss: 0.00112
epssPercentile: 0.01569
aliases:
  - GHSA-528h-pc64-c93x
ecosystem: npm
ingestedAt: '2026-09-03T21:08:46.155Z'
---

## Overview

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.5.0, the path filters pick, ignore, filter, and replace in src/core/filters/filter-base.js recompute the full path string from the nesting stack for every checkable token. Because the stack length equals the current nesting depth and a checkable token is emitted at every level, a depth D document costs O(D²) rather than O(D) to process. The issue is triggered by nesting depth rather than byte volume, including the documented pick({filter: 'data'}) traversal-until-match path, so an application that sends untrusted JSON through a string or RegExp filter can block the Node.js event loop and cause denial of service with a small deeply nested document. The streamArray, streamObject, and streamValues streamers are not affected because they use the constant-time asm.depth getter. This issue is fixed in version 3.5.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-71429)

Affected packages:

- `stream-json <= 3.4.0`

Patched in:

- `stream-json 3.5.0`

Source: https://github.com/advisories/GHSA-528h-pc64-c93x