uhop/stream-json Security Advisories | GitStock

medium2026-10-22

stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service

GHSA-jj87-hc4r-jwfw · CVE-2026-114129

medium2026-10-05

stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk

GHSA-hqr4-qq8f-hg3x · CVE-2026-104182

medium2026-10-05

stream-json has a prototype pollution issue: Assembler writes this.current[this.key] on plain objects

GHSA-mjw6-4jj6-33hc · CVE-2026-104183

medium2026-09-03

stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)

GHSA-528h-pc64-c93x · CVE-2026-71429