CVE-2026-104182

Name of the Vulnerable Software and Affected Versions stream-json versions prior to 3.6.0

Description The JSONC parser at stream-json/jsonc/parser.js and verifier at stream-json/jsonc/verifier.js restart comment-terminator scanning from the opening slash when a block or line comment spans an input chunk, while retaining the accumulated comment buffer. This behavior can lead to quadratic CPU work and stall the Node.js event loop if a large valid comment is delivered across many small chunks. This issue specifically affects the JSONC parser and does not impact the plain JSON parser. The attack vector is considered local as JSONC input typically consists of locally owned or user-controlled configuration.

Recommendations Update to version 3.6.0.