Description
stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, the JSONC parser at stream-json/jsonc/parser.js and verifier at stream-json/jsonc/verifier.js restart comment-terminator scanning from the opening slash whenever a block or line comment spans an input chunk, while retaining the accumulated comment buffer. Delivering a large valid comment across many small chunks therefore causes quadratic CPU work and can stall the Node.js event loop. The maintainer characterizes the attack vector as local because the documented JSONC input is locally owned or user-controlled configuration, rather than input intended for the open internet. This JSONC-only scope does not include the plain JSON parser, which advances through and discards consumed string and number data. This issue is fixed in version 3.6.0.
Published: 2026-10-01
Score: 6.2 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

The vulnerability in the stream-json library causes the JSONC parser and verifier to repeatedly scan the full accumulated comment whenever a block or line comment spans an input chunk. This causes quadratic CPU consumption and can stall the Node.js event loop, effectively denying service to the application. The weakness falls under CWE‑1322 and CWE‑407: Incorrect Resource Exhaustion Evaluation.

Affected Systems

The affected product is uhop's stream-json. Versions prior to 3.6.0 are vulnerable; the fix is included in release 3.6.0 and later.

Risk and Exploitability

The CVSS score of 6.2 reflects a moderate severity. Exploit likelihood is not quantified due to unavailable EPSS data, and the vulnerability is not listed in the CISA KEV catalog. The documented attack vector is local, meaning that an attacker would need to supply JSONC input from a locally controlled or user‑managed configuration. No known public exploits are reported as of this analysis.

Generated by OpenCVE AI on October 2, 2026 at 14:11 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to stream-json v3.6.0 or later, which removes the quadratic comment scanning bug.
  • If upgrading cannot be performed immediately, limit the size of JSONC input by validating configuration size before parsing to mitigate excessive CPU usage.
  • Reconfigure or modify the application to use the plain JSON parser for configuration files, avoiding JSONC parsing entirely when possible, as it does not exhibit this issue.

Generated by OpenCVE AI on October 2, 2026 at 14:11 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-hqr4-qq8f-hg3x stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk
History

Mon, 05 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 02 Oct 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-1322
References
Metrics threat_severity

None

 threat_severity

Moderate

Thu, 01 Oct 2026 23:00:00 +0000

Type Values Removed Values Added
First Time appeared Uhop
Uhop stream-json
Vendors & Products Uhop
Uhop stream-json

Thu, 01 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Description stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, the JSONC parser at stream-json/jsonc/parser.js and verifier at stream-json/jsonc/verifier.js restart comment-terminator scanning from the opening slash whenever a block or line comment spans an input chunk, while retaining the accumulated comment buffer. Delivering a large valid comment across many small chunks therefore causes quadratic CPU work and can stall the Node.js event loop. The maintainer characterizes the attack vector as local because the documented JSONC input is locally owned or user-controlled configuration, rather than input intended for the open internet. This JSONC-only scope does not include the plain JSON parser, which advances through and discards consumed string and number data. This issue is fixed in version 3.6.0.
Title stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk
Weaknesses CWE-407
References
Metrics cvssV3_1

{'score': 6.2, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Uhop Stream-json
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-05T20:20:30.414Z

Reserved: 2026-10-01T18:54:15.118Z

Link: CVE-2026-104182

cve-icon Vulnrichment

Updated: 2026-10-05T20:20:10.847Z

cve-icon NVD

Status : Deferred

Published: 2026-10-01T21:17:19.003

Modified: 2026-10-05T21:16:32.540

Link: CVE-2026-104182

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-01T20:15:39Z

Links: CVE-2026-104182 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-02T14:15:15Z

Weaknesses
  • CWE-1322

    Use of Blocking Code in Single-threaded, Non-blocking Context

  • CWE-407

    Inefficient Algorithmic Complexity