CVE-2026-104183

Name of the Vulnerable Software and Affected Versions stream-json versions prior to 3.6.0

Description The Assembler component materializes object properties using plain assignment. When an input key is named proto, it invokes the inherited setter, leading to the replacement of the parsed object prototype instead of creating an own data property. This can allow applications that rely on inherited values for authorization or feature decisions to consume attacker-controlled properties. Additionally, a null prototype may disrupt code expecting standard Object.prototype methods. While the global Object.prototype is not polluted, the issue occurs when parsing untrusted JSON.

Recommendations Update to version 3.6.0.