Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-104182— stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk

Quick assessment

Affected
uhop stream-json
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

stream-json 是一个用于处理 JSON 和 JSONC 的流组件微型库，具有极小的内存占用。在 3.6.0 版本之前，位于 的 JSONC 解析器和 中的验证器，在块注释或行注释跨越多个输入数据块时，会从起始斜杠处重新开始扫描注释终止符，同时保留已累积的注释缓冲区。因此，将一个大型有效注释拆分为许多小块进行传输会导致 CPU 执行呈二次方增长的计算量，从而可能阻塞 Node.js 事件循环。维护者将该攻击向量归类为本地型，因为文档中所述的 JSONC 输入通常是本地拥有或用户可控的配置数据，而非面向公开互

CVSS 6.2 · Medium EPSS 0.14% · P3

Possible ATT&CK Techniques 1 AI

T1496 · Resource Hijacking

Affected Version Matrix 1

VendorProduct Version RangeStatus
uhop stream-json < 3.6.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-104182

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk
Source: CVE Program / CVE List V5
Vulnerability Description
stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, the JSONC parser at stream-json/jsonc/parser.js and verifier at stream-json/jsonc/verifier.js restart comment-terminator scanning from the opening slash whenever a block or line comment spans an input chunk, while retaining the accumulated comment buffer. Delivering a large valid comment across many small chunks therefore causes quadratic CPU work and can stall the Node.js event loop. The maintainer characterizes the attack vector as local because the documented JSONC input is locally owned or user-controlled configuration, rather than input intended for the open internet. This JSONC-only scope does not include the plain JSON parser, which advances through and discards consumed string and number data. This issue is fixed in version 3.6.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
算法复杂性
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
uhop stream-json < 3.6.0 -

II. Public POCs for CVE-2026-104182

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-104182

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-104182 (1)

Vendor Pages for CVE-2026-104182 (1)

IV. Related Vulnerabilities

Same product: stream-json
Same vendor: uhop
Same weakness: CWE-407

V. Comments for CVE-2026-104182

No comments yet

Leave a comment