Description
stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. From 2.0.0 until 3.7.0, FlexAssembler compiles string and regular-expression path filters into matchers that join the full key stack on every container start. Because the key stack grows with unbounded object or array nesting, a document nested to depth D causes D joins whose cost grows with the current depth, resulting in quadratic CPU consumption on the single-threaded event loop. The join occurs before the rule match decision, so the attacker does not need to know the target schema. Consumers using only function filters or no rules are not affected. A crafted nested document can stall all concurrent work in a process that feeds it to an affected FlexAssembler. This issue is fixed in 3.7.0, which adds a default maximum depth.
Published: 2026-10-21
Score: 6.2 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

FlexAssembler compiles string and regular‑expression path filters by joining the full key stack whenever a container starts. Since the key stack grows with each level of nesting, a document with depth D causes D joins whose cost is proportional to the current depth, leading to O(depth²) CPU consumption that stalls the single‑threaded event loop. The attack does not require knowledge of the target schema; a crafted deeply nested JSON can fully exhaust the consuming process. This flaw is an instance of CWE-407 (Uncontrolled Resource Consumption) and CWE-770 (Difficulty in Mitigation).

Affected Systems

The vulnerability appears in uhop:stream-json from version 2.0.0 through 3.6.x. The issue is resolved in 3.7.0, which introduces a default maximum depth for FlexAssembler. Applications that import earlier versions and use string/regular‑expression path filters are affected.

Risk and Exploitability

The CVSS score of 6.2 indicates moderate impact; EPSS is < 1% and the vulnerability is not listed in CISA KEV, suggesting limited observed exploitation. However, any application that accepts arbitrary JSON from untrusted sources and forwards it to FlexAssembler is at risk of a CPU‑based denial of service. Successful exploitation requires only the ability to supply a deeply nested document, making the attack practical in many real‑world contexts.

Generated by OpenCVE AI on October 22, 2026 at 15:11 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade stream-json to version 3.7.0 or later, which adds a default maximum depth and fixes the quadratic consumption.
  • If a timely upgrade is not possible, configure FlexAssembler to disallow string or regular‑expression path filters, or limit the set of active filters to safe, simple rules.
  • As an interim protection, perform input validation or pre‑parsing of JSON to reject or truncate deeply nested structures before passing data to FlexAssembler.

Generated by OpenCVE AI on October 22, 2026 at 15:11 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-jj87-hc4r-jwfw stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service
History

Wed, 28 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-770
References
Metrics threat_severity

None

 threat_severity

Moderate

Thu, 22 Oct 2026 11:15:00 +0000

Type Values Removed Values Added
First Time appeared Uhop
Uhop stream-json
Vendors & Products Uhop
Uhop stream-json

Wed, 21 Oct 2026 17:45:00 +0000

Type Values Removed Values Added
Description stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. From 2.0.0 until 3.7.0, FlexAssembler compiles string and regular-expression path filters into matchers that join the full key stack on every container start. Because the key stack grows with unbounded object or array nesting, a document nested to depth D causes D joins whose cost grows with the current depth, resulting in quadratic CPU consumption on the single-threaded event loop. The join occurs before the rule match decision, so the attacker does not need to know the target schema. Consumers using only function filters or no rules are not affected. A crafted nested document can stall all concurrent work in a process that feeds it to an affected FlexAssembler. This issue is fixed in 3.7.0, which adds a default maximum depth.
Title stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service
Weaknesses CWE-407
References
Metrics cvssV3_1

{'score': 6.2, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Uhop Stream-json
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-28T17:16:23.694Z

Reserved: 2026-10-20T21:53:58.473Z

Link: CVE-2026-114129

cve-icon Vulnrichment

Updated: 2026-10-28T17:16:18.403Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-21T18:17:25.650

Modified: 2026-10-28T18:17:10.430

Link: CVE-2026-114129

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-21T17:34:48Z

Links: CVE-2026-114129 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T15:15:07Z

Weaknesses
  • CWE-407

    Inefficient Algorithmic Complexity

  • CWE-770

    Allocation of Resources Without Limits or Throttling