stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-71429 · CVE overview and exploitation status

EUVD-2026-70733

GHSA-528h-pc64-c93x

cve-program · CVE-2026-71429

• https://github.com/uhop/stream-json/security/advisories/GHSA-528h-pc64-c93x
• https://github.com/uhop/stream-json/commit/a869fb98aaef9225556f49901a8f55954ff856e6

euvd · EUVD-2026-70733

• https://github.com/uhop/stream-json/security/advisories/GHSA-528h-pc64-c93x
• https://github.com/uhop/stream-json/commit/a869fb98aaef9225556f49901a8f55954ff856e6

nvd · CVE-2026-71429

• https://github.com/uhop/stream-json/commit/a869fb98aaef9225556f49901a8f55954ff856e6
• https://github.com/uhop/stream-json/security/advisories/GHSA-528h-pc64-c93x

osv · GHSA-528h-pc64-c93x

• https://github.com/uhop/stream-json/security/advisories/GHSA-528h-pc64-c93x
• https://github.com/uhop/stream-json/commit/a869fb98aaef9225556f49901a8f55954ff856e6
• https://github.com/uhop/stream-json

No related changes are available here.