Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-114129— stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service

Quick assessment

Affected
uhop stream-json
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

stream-json 是一个用于处理 JSON 和 JSONC 的微型流组件库，旨在实现极低的内存占用。在 2.0.0 至 3.7.0 版本中，FlexAssembler 将字符串和正则表达式路径过滤器编译为匹配器，这些匹配器会在每个容器（对象或数组）启动时，对整个键栈（key stack）执行连接（join）操作。由于键栈的长度会随着对象或数组的嵌套深度无限制地增长，一个嵌套深度为 D 的文档将触发 D 次连接操作，而每次连接的成本又随当前深度线性增加，从而导致在单线程事件循环中产生二次方（O(n²)）的 CP

CVSS 6.2 · Medium

Possible ATT&CK Techniques 1 AI

T1499.003 · Application Exhaustion Flood

Affected Version Matrix 1

VendorProduct Version RangeStatus
uhop stream-json >= 2.0.0, < 3.7.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-114129

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service
Source: CVE Program / CVE List V5
Vulnerability Description
stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. From 2.0.0 until 3.7.0, FlexAssembler compiles string and regular-expression path filters into matchers that join the full key stack on every container start. Because the key stack grows with unbounded object or array nesting, a document nested to depth D causes D joins whose cost grows with the current depth, resulting in quadratic CPU consumption on the single-threaded event loop. The join occurs before the rule match decision, so the attacker does not need to know the target schema. Consumers using only function filters or no rules are not affected. A crafted nested document can stall all concurrent work in a process that feeds it to an affected FlexAssembler. This issue is fixed in 3.7.0, which adds a default maximum depth.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
算法复杂性
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
uhop stream-json >= 2.0.0, < 3.7.0 -

II. Public POCs for CVE-2026-114129

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-114129

请登录查看更多情报信息。

Other References for CVE-2026-114129 (4)

IV. Related Vulnerabilities

Same product: stream-json
Same vendor: uhop
Same weakness: CWE-407

V. Comments for CVE-2026-114129

No comments yet

Leave a comment