CVE-2026-114129 uhop CVE debrief

Who should care

Defenders who use the `stream-json` package in their applications should assess exposure and implement compensating controls to prevent exploitation. This includes verifying the version of `stream-json` in use and upgrading to version 3.7.0 or later.

Why it matters

CVE-2026-114129 is a denial-of-service vulnerability in the `stream-json` package that can be exploited by an unauthenticated party. Defenders should prioritize verifying the version of `stream-json` in use and upgrading to version 3.7.0 or later.

• Denial of service through CPU exhaustion
• Potential for unauthenticated exploitation
• Need for version verification and upgrading

Technical summary

The `FlexAssembler` in the `stream-json` package is vulnerable to a denial-of-service attack. An unauthenticated party can supply JSON bytes to a pipeline that uses a `FlexAssembler` with a string or RegExp rule filter, causing a small input to stall the process. The vulnerability is caused by the `FlexAssembler` reconstructing JavaScript values from the parser token stream and supporting custom containers selected by path-matching rules. When a rule `filter` is a string or RegExp, `compileFilter` returns a matcher that computes the joined path from the full key stack before making any match decision. This results in a time complexity of O(D^2) for JSON documents of depth D. To address this vulnerability, it is

Defensive priority

Defenders should prioritize verifying the version of `stream-json` in use and upgrading to version 3.7.0 or later. Additionally, defenders should assess exposure and implement compensating controls to prevent exploitation.

Recommended defensive actions

• Verify the version of `stream-json` in use and upgrade to version 3.7.0 or later
• Assess exposure and implement compensating controls to prevent exploitation
• Monitor for suspicious activity and implement logging and alerting
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is caused by the `FlexAssembler` reconstructing JavaScript values from the parser token stream and supporting custom containers selected by path-matching rules. When a rule `filter` is a string or RegExp, `compileFilter` returns a matcher that computes the joined path from the full key stack before making any match decision.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.