CVE-2026-114129

Name of the Vulnerable Software and Affected Versions stream-json versions 2.0.0 through 3.6.9

Description FlexAssembler compiles string and regular-expression path filters into matchers that join the full key stack on every container start. Due to unbounded object or array nesting, a document nested to depth D causes D joins with costs that grow with the current depth, leading to quadratic CPU consumption on the single-threaded event loop. This process occurs before the rule match decision, allowing a crafted nested document to stall all concurrent work in a process using an affected FlexAssembler without requiring knowledge of the target schema. Users who employ only function filters or no rules are not affected.

Recommendations Update to version 3.7.0.