CVE-2026-104182: stream-json Denial of Service via Inefficient JSONC Comment Parsing
Summary
CVE-2026-104182: stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk. Affects stream-json versions < 3.6.0. Fixed in 3.6.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
stream-json is a popular Node.js library designed for parsing and processing large JSON files in a streaming manner. It allows developers to handle JSON data efficiently without loading the entire file into memory. The library includes a JSONC parser that supports comments in JSON data. However, a recent vulnerability has been identified in the JSONC parser and verifier, which can lead to significant performance issues when processing certain types of input.
Vulnerability Detail
The vulnerability arises from the JSONC parser and verifier's method of scanning comments for their terminators. When a comment does not finish within the current buffer, the parser re-scans the entire accumulated comment on each new input chunk. This results in a quadratic time complexity (O(n²)) when processing large comments delivered in multiple chunks. An attacker can exploit this by sending a large, valid comment, causing the event loop to stall and leading to a denial of service (DoS) condition. The vulnerability is classified under CWE-407, indicating an algorithmic complexity issue in a streaming context.
How To Fix
Latest published version: 3.7.0 as of 23 Oct 2026
npm install stream-json@3.7.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.6.0
This is the first release that contains the fix.
npm install stream-json@3.6.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the JSONC parser for untrusted input. Instead, use the plain JSON parser provided by the stream-json library, which does not exhibit the same vulnerability. Here is an example of how to use the plain JSON parser:
import { parser } from 'stream-json';
const jsonStream = parser();
jsonStream.on('data', (data) => {
console.log(data);
});
// Feed data to the parser as needed.
Conclusion
The CVE-2026-104182 vulnerability in the stream-json package poses a risk of denial of service due to inefficient comment parsing in the JSONC parser. Users are advised to update to version 3.6.0 or later to mitigate this risk. For immediate safety, using the plain JSON parser is recommended.
See every vulnerability recorded for stream-json →
FAQ
The CVSS score of this vulnerability is 6.2, indicating a moderate severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By utilizing the package-lock.json file, Vulert can identify if your application is affected by this vulnerability.
The primary impact is a denial of service (DoS) condition, where an attacker can cause the event loop to stall, affecting the performance and availability of the application.
Yes, the plain JSON parser in the stream-json library is safe to use and does not have the same vulnerabilities as the JSONC parser.
If you cannot update the package right away, consider using the plain JSON parser as a temporary measure to avoid the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for stream-json.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
