CVE-2026-71429

Name of the Vulnerable Software and Affected Versions stream-json versions prior to 3.5.0

Description Path filters pick, ignore, filter, and replace in src/core/filters/filter-base.js recompute the full path string from the nesting stack for every checkable token. This results in a quadratic time complexity O(D²) relative to the nesting depth D, rather than linear time O(D). An attacker can trigger a denial of service by sending a small, deeply nested JSON document, which blocks the Node.js event loop and pins the CPU. This issue occurs regardless of the byte volume and affects both string and RegExp filters.

Recommendations Update to version 3.5.0 or later. As a temporary mitigation, restrict the use of the pick, ignore, filter, and replace filters when processing untrusted JSON input.