Executive brief
stream-json is a Node.js library for processing large JSON files with low memory overhead. The library's path filtering features (pick, ignore, filter, replace) have a severe algorithmic inefficiency that causes CPU to scale quadratically with JSON nesting depth rather than linearly. An attacker can send a tiny deeply-nested JSON payload that blocks the Node.js event loop for seconds to minutes, causing denial of service to any application processing untrusted JSON through these filters.
Technical details
The vulnerability is an inefficient algorithmic complexity issue in filter-base.js affecting the pick, ignore, filter, and replace path-matching filters. The root cause is that the filters recompute the full path string from the nesting stack via stack.join(separator) on every checkable token emitted during parsing. Since the stack depth equals the nesting depth D and checkable tokens are emitted at every level, the complexity becomes O(D²) instead of O(D). The attack vector requires no authentication or user interaction—any service accepting untrusted or large JSON and using these filters is vulnerable. An attacker can craft deeply-nested JSON (e.g., 360 KB of pure nesting) that blocks a CPU core for ~12 seconds; extrapolation suggests 1–2 MB could cause single-digit minutes of CPU consumption per request. The vulnerability was fixed in version 3.5.0 by enforcing a default maximum nesting depth of 1024 and throwing a RangeError beyond it; the limit can be disabled with maxDepth: Infinity if needed.
Affected products
- uhop stream-json <= 3.4.0
Timeline
- 2026-09-03: disclosed: GHSA-528h-pc64-c93x published
- 2026-09-06: patched: Fixed in version 3.5.0 with maxDepth option