CVE-2026-114129: stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service
stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. From 2.0.0 until 3.7.0, FlexAssembler compiles string and regular-expression path filters into matchers that join the full key stack on every container start. Because the key stack grows with unbounded object or array nesting, a document nested to depth D causes D joins whose cost grows with the current depth, resulting in quadratic CPU consumption on the single-threaded event loop. The join occurs before the rule match decision, so the attacker does not need to know the target schema. Consumers using only function filters or no rules are not affected. A crafted nested document can stall all concurrent work in a process that feeds it to an affected FlexAssembler. This issue is fixed in 3.7.0, which adds a default maximum depth.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
stream-jsonto a version that resolves this vulnerability.Fixed in 3.7.0
Event History
Frequently Asked Questions
Which deployments are affected?
Affected deployments use stream-json versions from 2.0.0 through versions before 3.7.0 and feed input to FlexAssembler with string or regular-expression path filters. Consumers that use only function filters or no rules are not affected.
What does an attacker need to exploit this?
An attacker needs to cause the application to process a crafted, deeply nested JSON or JSONC document through an affected FlexAssembler. No privileges or user interaction are required, and the attacker does not need to know the target schema because the expensive key-stack join occurs before rule matching.
What is the operational impact?
Deep nesting causes quadratic CPU consumption on the single-threaded event loop. A crafted document can stall concurrent work handled by the process.
What should teams do if they cannot patch immediately?
Avoid using string or regular-expression path filters with FlexAssembler, or avoid using rules entirely; function filters are not affected. Limit or reject untrusted documents with excessive nesting before they reach the affected FlexAssembler.
Which version contains the fix?
Version 3.7.0 fixes the issue by adding a default maximum depth.