CVE-2026-71429 stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)
Attackers can cause denial of service in applications using stream-json by sending deeply nested JSON, blocking the event loop due to inefficient path filtering.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-71429?
CVE-2026-71429 is a medium-severity denial of service vulnerability in uhop stream-json, published on 3 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.5.0, the path filters pick, ignore, filter, and replace in src/core/filters/filter-base.js recompute the full path string from the nesting stack for every checkable token. Because the stack length equals the current nesting depth and a checkable token is emitted at every level, a depth D document costs O(D²) rather than O(D) to process. The issue is triggered by nesting depth rather than byte volume, including the documented pick({filter: 'data'}) traversal-until-match path, so an application that sends untrusted JSON through a string or RegExp filter can block the Node.js event loop and cause denial of service with a small deeply nested document. The streamArray, streamObject, and streamValues streamers are not affected because they use the constant-time asm.depth getter. This issue is fixed in version 3.5.0.
Weakness: CWE-407
Which versions are affected by CVE-2026-71429?
2 open source packages ship an affected version, including stream-json.
| Package | Affected | Fixed in |
|---|---|---|
stream-json npm | All versions | 3.5.0 |
stream-json npm | All versions | 3.5.0 |
How do I fix CVE-2026-71429?
Upgrade stream-json to 3.5.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-71429 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-71429 exists.
Sources
Also known as CLEANSTART-2026-AK31970, CLSA-2026-1790541875, GHSA-528h-pc64-c93x.