CVE-2026-71429

About vulnerability

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.5.0, the path filters pick, ignore, filter, and replace in src/core/filters/filter-base.js recompute the full path string from the nesting stack for every checkable token. Because the stack length equals the current nesting depth and a checkable token is emitted at every level, a depth D document costs O(D²) rather than O(D) to process. The issue is triggered by nesting depth rather than byte volume, including the documented pick({filter: ‘data’}) traversal-until-match path, so an application that sends untrusted JSON through a string or RegExp filter can block the Node.js event loop and cause denial of service with a small deeply nested document. The streamArray, streamObject, and streamValues streamers are not affected because they use the constant-time asm.depth getter. This issue is fixed in version 3.5.0.

Affected product:

@keystonehq/sol-keyring , @lg-tools/meta , @particle-network/solana-wallet , appkit , buffer-layout-utils , bundle-stats , clerk-chrome-extension , clerk-clerk-expo , clerk-clerk-js , coral-xyz-anchor , create-strapi , create-strapi-app , ethereumjs-client , fractalwagmi-solana-wallet-adapter , javascript , jayson , leafygreen-ui , leafygreen-ui-a11y , leafygreen-ui-chip , leafygreen-ui-code , leafygreen-ui-combobox , leafygreen-ui-compound-component , leafygreen-ui-date-picker , leafygreen-ui-guide-cue , leafygreen-ui-hooks , leafygreen-ui-input-option , leafygreen-ui-search-input , leafygreen-ui-select , leafygreen-ui-skeleton-loader , leafygreen-ui-table , leafygreen-ui-testing-lib , leafygreen-ui-text-input , leafygreen-ui-toggle , leafygreen-ui-typography , ledgerhq-coin-solana , ledgerhq-coin-tester-solana , ledgerhq-device-signer-kit-solana , ledgerhq-live-cli , ledgerhq-live-common , lg-chat-message-prompts , lg-chat-message-rating , lg-chat-rich-links , lg-chat-title-bar , lg-tools-cli , lg-tools-codemods , lg-tools-create , lg-tools-install , lg-tools-link , lg-tools-prompt-kit , lg-tools-slackbot , lg-tools-storybook-addon , lg-tools-storybook-decorators , lg-tools-test , lg-tools-validate , magic-js , mobile-wallet-adapter , native-to-anchor , reown-appkit , reown-appkit-adapter-bitcoin , reown-appkit-adapter-ethers , reown-appkit-adapter-ethers5 , reown-appkit-adapter-solana , reown-appkit-adapter-wagmi , reown-appkit-common , reown-appkit-controllers , reown-appkit-core , reown-appkit-experimental , reown-appkit-pay , reown-appkit-scaffold-ui , reown-appkit-siwe , reown-appkit-siwx , reown-appkit-ui , reown-appkit-universal-connector , reown-appkit-utils , reown-appkit-wallet , reown-appkit-wallet-button , salmon-adapter-sdk , sol-wallet-adapter , solana-connector-debugger , solana-embed , solana-foundation-solana-web3.js , solana-mobile-mobile-wallet-adapter-protocol , solana-mobile-mobile-wallet-adapter-protocol-web3js , solana-program-library , solana-wallet-adapter-alpha , solana-wallet-adapter-base-ui , solana-wallet-adapter-bitkeep , solana-wallet-adapter-bitpie , solana-wallet-adapter-clover , solana-wallet-adapter-coin98 , solana-wallet-adapter-coinbase , solana-wallet-adapter-coinhub , solana-wallet-adapter-example , solana-wallet-adapter-fractal , solana-wallet-adapter-huobi , solana-wallet-adapter-hyperpay , solana-wallet-adapter-keystone , solana-wallet-adapter-krystal , solana-wallet-adapter-ledger , solana-wallet-adapter-mathwallet , solana-wallet-adapter-nufi , solana-wallet-adapter-onto , solana-wallet-adapter-particle , solana-wallet-adapter-react-ui , solana-wallet-adapter-saifu , solana-wallet-adapter-sky , solana-wallet-adapter-spot , solana-wallet-adapter-tokenary , solana-wallet-adapter-trust , solana-wallet-adapter-xdefi , solana-wallet-standard-features , solana-wallet-standard-wallet-adapter , solana-wallet-standard-wallet-adapter-base , solana-wallet-standard-wallet-adapter-react , solflare-wallet-sdk , strapi , strapi-admin , strapi-cloud-cli , strapi-content-manager , strapi-content-releases , strapi-content-type-builder , strapi-core , strapi-data-transfer , strapi-database , strapi-email , strapi-generators , strapi-i18n , strapi-logger , strapi-openapi , strapi-permissions , strapi-plugin-cloud , strapi-plugin-color-picker , strapi-plugin-documentation , strapi-plugin-graphql , strapi-plugin-sentry , strapi-plugin-users-permissions , strapi-provider-email-mailgun , strapi-provider-email-sendgrid , strapi-provider-upload-aws-s3 , strapi-provider-upload-cloudinary , strapi-provider-upload-local , strapi-review-workflows , strapi-strapi , strapi-types , strapi-typescript-utils , strapi-upgrade , strapi-upload , strapi-utils , stream-json , wallet-adapter , wallet-standard , wallet-ui , wallet-ui-core , wallet-ui-react , wallet-ui-react-native-kit , wallet-ui-react-native-web3js , wallet-ui-tailwind , walletconnect-solana-adapter , web3auth , web3auth-web

Affected packages:

stream-json @ 1.8.0 (+1525 more)