CVE-2026-71429: stream-json path filters algorithmic complexity denial of service

CVE-2026-71429 · Severity: medium · CVSS 6.2 · Published 2026-09-03

stream-json is a Node.js library for processing large JSON files with low memory overhead. The library's path filtering features (pick, ignore, filter, replace) have a severe algorithmic inefficiency that causes CPU to scale quadratically with JSON nesting depth rather than linearly. An attacker can send a tiny deeply-nested JSON payload that blocks the Node.js event loop for seconds to minutes, causing denial of service to any application processing untrusted JSON through these filters.

Technologies: stream-json (npm). Vendors: npm.

Quick answers

Is CVE-2026-71429 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-71429 being exploited in the wild.
How severe is CVE-2026-71429?
Medium severity, with a CVSS score of 6.2, published 3 September 2026.
Which products and versions are affected?
stream-json (npm) <= 3.4.0, SEMVER:introduced=0,fixed=3.5.0.
Is there a fix for CVE-2026-71429?
Yes. stream-json (npm): upgrade to 3.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-71429 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-71429?
Check whether you run stream-json (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • stream-json (npm): upgrade to 3.5.0 or later
    npm install stream-json@3.5.0

Technical details

The vulnerability is an inefficient algorithmic complexity issue in filter-base.js affecting the pick, ignore, filter, and replace path-matching filters. The root cause is that the filters recompute the full path string from the nesting stack via stack.join(separator) on every checkable token emitted during parsing. Since the stack depth equals the nesting depth D and checkable tokens are emitted at every level, the complexity becomes O(D²) instead of O(D). The attack vector requires no authentication or user interaction—any service accepting untrusted or large JSON and using these filters is vulnerable. An attacker can craft deeply-nested JSON (e.g., 360 KB of pure nesting) that blocks a CPU core for ~12 seconds; extrapolation suggests 1–2 MB could cause single-digit minutes of CPU consumption per request. The vulnerability was fixed in version 3.5.0 by enforcing a default maximum nesting depth of 1024 and throwing a RangeError beyond it; the limit can be disabled with maxDepth: Infinity if needed.

Affected products

  • uhop stream-json <= 3.4.0

Identifiers

  • CVE-2026-71429
  • GHSA-528h-pc64-c93x

Timeline

  • 2026-09-03: disclosed: GHSA-528h-pc64-c93x published
  • 2026-09-06: patched: Fixed in version 3.5.0 with maxDepth option

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.