The path filters pick, ignore, filter, and replace in stream-json recompute a full path string from the nesting stack for every token, causing the processing cost to grow with the square of the JSON depth. A sharply nested JSON document, even with a modest number of bytes, can therefore stall the Node.js event loop for seconds or even minutes, effectively denying service to the application that uses the library.

Applications that include the uhop:stream-json library older than version 3.5.0 and that use any of the vulnerable filters are affected. The streamArray, streamObject, and streamValues streamers are not impacted because they use a constant‑time depth getter. Any component that forwards untrusted JSON through these filters can trigger the issue.

The CVSS score of 6.2 indicates moderate severity. The EPSS score is not available and the vulnerability is not listed in CISA's KEV catalog. An attacker only needs the ability to supply arbitrary JSON to a vulnerable stream; no special authentication or privileges are required. By crafting a deeply nested JSON payload the attacker can block the event loop and cause a denial of service affecting all users of the exposed service while the loop remains unresponsive.