Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-104183 · GHSA-mjw6-4jj6-33hc

stream-json has a prototype pollution issue: Assembler writes this.current[this.key] on plain objects

Risk score
42/100
CVSS
5.1 v3.1
Exploit chance (30 days)
0.2%
Published
1 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, Assembler materializes object properties with plain assignment, so an input key named __proto__ invokes the inherited setter and causes parsed object prototype replacement instead of creat…
Affected
stream-json (npm) < 3.6.0
Fix
Upgrade stream-json to 3.6.0 or later.
Exploitation
Public proof of concept

Story map

Story map: stream-jsonTHE FLAWSTHE FIXCVE-2026-104183Stream-json has a prototypepollution issue: Assemblerwrites this.current[this.key]…CVSS 5.1 · EPSS 0%CVE-2026-114129FlexAssembler string/RegExppath filters join the full keystack per container start…CVSS 6.2 · EPSS 0%CVE-2026-104182JSONC parser and verifierre-scan the whole accumulatedcomment on every input chunkCVSS 6.2 · EPSS 0%Upgrade stream-json3.6.0 · 3.7.0or later on your release lineWho is exposedstream-json (npm) >= 2.0.0, <=3.6.0YELLOW · PLAN IT INstream-jsonstream-json is a micro-libraryof stream components forprocessing JSON and JSONC witha minimal memory footprint.From 2.0.0 until 3.7.0,FlexAssembler compiles stringand regular-expression path…Where it standsPublic proof of conceptCONNECTS TOSame weaknessPrototype pollution (CWE-1321)40 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

stream-json: Yellow, plan it in. stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. From 2.0.0 until 3.7.0, FlexAssembler compiles string and regular-expression path filters into matchers that join the full key stack on every container start. Because the key stack grows with unbounded ob…

The flaws

  • CVE-2026-104183: Stream-json has a prototype pollution issue: Assembler writes this.current[this.key] on plain objects (CVSS 5.1 · EPSS 0%)
  • CVE-2026-114129: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service (CVSS 6.2 · EPSS 0%)
  • CVE-2026-104182: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk (CVSS 6.2 · EPSS 0%)

The fix

Upgrade stream-json: 3.6.0 · 3.7.0 or later on your release line

Who is exposed: stream-json (npm) >= 2.0.0, <= 3.6.0

Where it stands

  • Public proof of concept

Connects to

Why it is Yellow

  • CVSS 5.1 medium
  • Public exploit or proof of concept referenced
  • On your watchlist: npm

Affected packages

PackageEcosystemVulnerableFixed in
stream-jsonnpm< 3.6.03.6.0

References

Original description

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, Assembler materializes object properties with plain assignment, so an input key named __proto__ invokes the inherited setter and causes parsed object prototype replacement instead of creating an own data property. Applications that make authorization or feature decisions from inherited values can therefore consume attacker-controlled properties, and a null prototype can disrupt code that expects Object.prototype methods. The researcher treats parsing untrusted JSON as part of the project contract, while the maintainer states that documented inputs are locally owned dumps, exports, or logs and characterizes the attack vector as local. The global Object.prototype is not polluted. This issue is fixed in version 3.6.0.

Last activity 1 Oct 2026. Patch Forecast updates every hour.