CVE-2026-114129

Awaiting Analysis Awaiting Analysis - Queue

ReDoS Vulnerability in stream-json Due to Unbounded Key Stack Joins

Publication date: 2026-10-21

Last updated on: 2026-10-28

Assigner: GitHub, Inc.

Description

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. From 2.0.0 until 3.7.0, FlexAssembler compiles string and regular-expression path filters into matchers that join the full key stack on every container start. Because the key stack grows with unbounded object or array nesting, a document nested to depth D causes D joins whose cost grows with the current depth, resulting in quadratic CPU consumption on the single-threaded event loop. The join occurs before the rule match decision, so the attacker does not need to know the target schema. Consumers using only function filters or no rules are not affected. A crafted nested document can stall all concurrent work in a process that feeds it to an affected FlexAssembler. This issue is fixed in 3.7.0, which adds a default maximum depth.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-28

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-114129

EUVD

EUVD-2026-107412

Affected Vendors & Products

Vendor	Product	Version / Range
uhop	stream-json	>= 2.0.0, < 3.7.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-407	An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

Executive Summary

This vulnerability is a Denial-of-Service (DoS) flaw in the stream-json library's FlexAssembler component. It occurs when processing deeply nested JSON documents. The library joins the full key stack on every container start without a depth limit, causing quadratic CPU consumption as nesting depth increases. This stalls the event loop, blocking all concurrent work in the process.

Detection Guidance

Detecting this vulnerability requires checking if your system uses a vulnerable version of stream-json (2.0.0 to 3.6.0). Inspect package.json or dependency files for stream-json. Monitor CPU usage spikes during JSON processing, especially with deeply nested inputs. Use tools like npm audit or yarn audit to check for vulnerable versions.

Impact Analysis

An attacker can exploit this by supplying a crafted JSON document with extreme nesting depth. This causes the event loop to stall for over a second with a 96 KB input (depth 16000), leading to high CPU usage and potential service unavailability. Systems processing untrusted JSON inputs are most at risk.

Compliance Impact

This vulnerability primarily impacts availability by causing CPU exhaustion through deeply nested JSON documents, which could lead to service disruptions. While it does not directly affect confidentiality or integrity, prolonged downtime may indirectly impact compliance with standards like GDPR (data processing delays) or HIPAA (system availability for critical healthcare operations).

Mitigation Strategies

Upgrade stream-json to version 3.7.0 or later to apply the fix. If upgrading is not possible, implement a depth limit for JSON parsing by setting maxDepth to a reasonable value (e.g., 1024) in FlexAssembler configurations. Avoid using string or RegExp path filters in untrusted environments.

Hi! I’m here to help you understand CVE-2026-114129. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...