CVE-2026-104182

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, the JSONC parser at stream-json/jsonc/parser.js and verifier at stream-json/jsonc/verifier.js restart comment-terminator scanning from the opening slash whenever a block or line comment spans an input chunk, while retaining the accumulated comment buffer. Delivering a large valid comment across many small chunks therefore causes quadratic CPU work and can stall the Node.js event loop. The maintainer characterizes the attack vector as local because the documented JSONC input is locally owned or user-controlled configuration, rather than input intended for the open internet. This JSONC-only scope does not include the plain JSON parser, which advances through and discards consumed string and number data. This issue is fixed in version 3.6.0.

• CWE-407

• https://github.com/uhop/stream-json/commit/c0299dc168ce9455ef5ca5b6a0f6850ee7fa0468
• https://github.com/uhop/stream-json/releases/tag/3.6.0
• https://github.com/uhop/stream-json/security/advisories/GHSA-hqr4-qq8f-hg3x

Published

Oct 1, 2026

Last Modified

Oct 1, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-104020Uncontrolled recursion in the Ion reader in Amazon Ion Pytho…7.5
• CVE-2026-104056Authlib version 1.7.2 and below contains a vulnerability whe…
• CVE-2026-104057Podgrab contains an unauthenticated denial-of-service vulner…7.5
• CVE-2026-104058Podgrab contains a missing authentication vulnerability in w…5.3
• CVE-2026-104059Lektor 3.3.14 and 3.4.0b15 contains a cross-site request for…8.1
• CVE-2026-104181Filament is a collection of full-stack components for accele…5.4
• CVE-2026-104183stream-json is a micro-library of stream components for proc…5.1
• CVE-2026-1042The WP Hello Bar plugin for WordPress is vulnerable to Store…4.4
• CVE-2026-10420Untrusted pointer dereference vulnerability in Samsung Open …5.5
• CVE-2026-104286An improper limitation of a pathname to a restricted directo…9.8
• CVE-2026-1043The PostmarkApp Email Integrator plugin for WordPress is vul…4.4
• CVE-2026-1044The Tennis Court Bookings plugin for WordPress is vulnerable…4.4