AIKIDO-2026-296635
stream-json is vulnerable to Denial of Service (DoS)
62
Medium Risk
This Affects:
stream-jsonTL;DR
FlexAssembler in stream-json compiles a string or RegExp path filter into a matcher that runs keyStack.join(separator) on every container start, with no bound on nesting depth. A JSON document nested to depth D drives D container start joins that each cost O(D), giving O(D^2) CPU on the event loop, and around 96 KB of deeply nested input can stall the process for over a second. The fix adds a maxDepth guard that throws a RangeError past the configured limit and replaces the per container join with incremental path matching.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you use FlexAssembler with a string or RegExp path filter on object or array rules.
Background info
stream-json is vulnerable to Denial of Service (DoS) in versions 2.0.0 - 3.6.0.
How to fix this
Upgrade the stream-json library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.