CVE-2026-71429 - stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)
Brief
CVE ID : CVE-2026-71429
Published : Sept. 3, 2026, 8:15 p. m.
- 25 minutes ago
Description : stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.
- 0, the path filters pick, ignore, filter, and replace in src/core/filters/filter-base. js recompute the full path string from the nesting stack for every checkable token.
Because the stack length equals the current nesting depth and a checkable token is emitted at every level, a depth D document costs O(D²) rather than O(D) to process. The issue is triggered by nesting depth rather than byte volume, including the documented pick({filter: 'data'}) traversal-until-match path, so an application that sends untrusted JSON through a string or RegExp filter can block the Node.
js event loop and cause denial of service with a small deeply nested document.