stream-json — Vulnerabilities & Security Advisories 4

All 4 CVE vulnerabilities found in stream-json, with AI-generated Chinese analysis, references, and POCs.

Vendor: uhop

CVE ID	Title	CVSS	Severity	Published
CVE-2026-114129	stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service CWE-407	6.2	Medium	2026-10-21
CVE-2026-104183	stream-json: Prototype pollution: Assembler writes this.current[this.key] on plain objects CWE-1321	5.1	Medium	2026-10-01
CVE-2026-104182	stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk CWE-407	6.2	Medium	2026-10-01
CVE-2026-71429	stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS) CWE-407	6.2	Medium	2026-09-03

All 4 known CVE vulnerabilities affecting stream-json with full Chinese analysis, references, and POCs where available.