CVE-2026-71429: 
JavaScript vulnerability analysis and mitigation

CVE-2026-71429 is a denial-of-service vulnerability in the stream-json npm package (by uhop) caused by quadratic algorithmic complexity (O(D²)) in its path filter functions. The pick, ignore, filter, and replace filters in src/core/filters/filter-base.js recompute the full path string from the nesting stack on every checkable token, meaning a deeply nested JSON document of depth D incurs O(D²) processing cost rather than O(D). All versions up to and including 3.4.0 are affected; version 3.5.0 contains the fix. The vulnerability was first published on July 7, 2026, and added to the GitHub Advisory Database on September 3, 2026, with a CVSS v3.1 base score of 6.2 (Medium) (Github Advisory, Red Hat Bugzilla).

The root cause is CWE-407 (Inefficient Algorithmic Complexity) and CWE-1046 (Creation of Immutable Text Using String Concatenation). In filter-base.js, both stringFilter and regExpFilter call stack.join(separator) on every invocation, which is an O(depth) operation. Since the filter is called once per nesting level for every checkable token, processing a document of depth D results in O(D²) total work. This is triggered purely by document structure (nesting depth), not byte volume — a ~360 KB payload of pure nesting can block the Node.js event loop for approximately 12 seconds, and extrapolating to 1–2 MB reaches single-digit minutes of CPU time per request. The streamArray, streamObject, and streamValues streamers are not affected because they use the constant-time asm.depth getter. A public proof-of-concept is included in the advisory (Github Advisory).

Successful exploitation causes a remote, unauthenticated denial-of-service condition against any Node.js application that processes untrusted JSON through the pick, ignore, filter, or replace filters with a string or RegExp path — the library's primary documented use case. A single crafted request can pin a CPU core and block the Node.js event loop for seconds to minutes, degrading or completely halting the service. There is no confidentiality or integrity impact; the vulnerability is limited to availability (Github Advisory, Red Hat Bugzilla).

A public proof-of-concept is included in the official security advisory and requires no authentication or special privileges to execute. The EPSS score is 0.0 as of the time of disclosure, and there is no evidence of in-the-wild exploitation or inclusion in the CISA KEV catalog. No threat actor attribution has been reported. The attack requires only the ability to send a crafted JSON body to an application using the affected filters (Github Advisory).

1. Identify a target: Find a Node.js application that accepts untrusted JSON input and processes it using stream-json version ≤ 3.4.0 with pick, ignore, filter, or replace filters (e.g., an API endpoint that extracts a field from a JSON body).
2. Craft the payload: Construct a deeply nested JSON document that never matches the filter's target key. For example, generate a document of depth D using '{"meta":'.repeat(D) + '1' + '}'.repeat(D). A depth of 40,000 produces a ~360 KB document.
3. Send the payload: Submit the crafted JSON body to the target endpoint via an HTTP POST or equivalent request. No authentication is required if the endpoint is public.
4. Observe the effect: The server's Node.js event loop becomes blocked for seconds to minutes (proportional to D²), causing the service to become unresponsive to all other requests during that period. Repeated requests can sustain the denial-of-service condition (Github Advisory).

• Network: Repeated HTTP requests with large, deeply nested JSON bodies (high nesting depth relative to byte size) sent to API endpoints; requests with payloads consisting almost entirely of repeated object/array open tokens with minimal actual data.
• Logs: Node.js application logs showing prolonged request processing times or event loop lag warnings; HTTP requests that take seconds to minutes to complete for small payloads.
• Process: Sustained high CPU usage on the Node.js process without corresponding high memory usage or large payload sizes; event loop delay metrics spiking significantly during request processing.

Upgrade stream-json to version 3.5.0 or later, which caps JSON nesting depth at 1024 by default and throws a RangeError for inputs exceeding this limit. If upgrading immediately is not possible, consider adding application-level input validation to reject JSON bodies with excessive nesting depth before they reach the stream-json filters. The maxDepth option can be set to a custom value (e.g., pick({ filter: 'data', maxDepth: 100 })), or set to Infinity to disable the limit (not recommended for untrusted input). The streamArray, streamObject, and streamValues APIs are not affected and can be used as alternatives where applicable (Github Advisory, Fix Commit).

The vulnerability was reported by researcher ataberk-xyz and the fix was authored and published by the library maintainer (uhop). Red Hat tracked the issue via their security response process (Bugzilla bug 2528227). No significant broader media coverage or notable social media commentary has been identified beyond standard vulnerability database aggregation (Github Advisory, Red Hat Bugzilla).