CVE-2026-104183

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, Assembler materializes object properties with plain assignment, so an input key named __proto__ invokes the inherited setter and causes parsed object prototype replacement instead of creating an own data property. Applications that make authorization or feature decisions from inherited values can therefore consume attacker-controlled properties, and a null prototype can disrupt code that expects Object.prototype methods. The researcher treats parsing untrusted JSON as part of the project contract, while the maintainer states that documented inputs are locally owned dumps, exports, or logs and characterizes the attack vector as local. The global Object.prototype is not polluted. This issue is fixed in version 3.6.0.

• CWE-1321

• https://github.com/uhop/stream-json/commit/2f2d35bbb547306991ded6487a279154d865a358
• https://github.com/uhop/stream-json/releases/tag/3.6.0
• https://github.com/uhop/stream-json/security/advisories/GHSA-mjw6-4jj6-33hc
• https://github.com/uhop/stream-json/security/advisories/GHSA-mjw6-4jj6-33hc

Published

Oct 1, 2026

Last Modified

Oct 1, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-104056Authlib version 1.7.2 and below contains a vulnerability whe…
• CVE-2026-104057Podgrab contains an unauthenticated denial-of-service vulner…7.5
• CVE-2026-104058Podgrab contains a missing authentication vulnerability in w…5.3
• CVE-2026-104059Lektor 3.3.14 and 3.4.0b15 contains a cross-site request for…8.1
• CVE-2026-104181Filament is a collection of full-stack components for accele…5.4
• CVE-2026-104182stream-json is a micro-library of stream components for proc…6.2
• CVE-2026-1042The WP Hello Bar plugin for WordPress is vulnerable to Store…4.4
• CVE-2026-10420Untrusted pointer dereference vulnerability in Samsung Open …5.5
• CVE-2026-104286An improper limitation of a pathname to a restricted directo…9.8
• CVE-2026-1043The PostmarkApp Email Integrator plugin for WordPress is vul…4.4
• CVE-2026-1044The Tennis Court Bookings plugin for WordPress is vulnerable…4.4
• CVE-2026-1045The Viet contact plugin for WordPress is vulnerable to Store…4.4