CVE-2026-104182

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-104182
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104182.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-104182
Aliases
  • GHSA-hqr4-qq8f-hg3x
Published
2026-10-01T20:15:39Z
Modified
2026-10-04T02:30:52Z
Severity
  • 6.2 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk
Details

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, the JSONC parser at stream-json/jsonc/parser.js and verifier at stream-json/jsonc/verifier.js restart comment-terminator scanning from the opening slash whenever a block or line comment spans an input chunk, while retaining the accumulated comment buffer. Delivering a large valid comment across many small chunks therefore causes quadratic CPU work and can stall the Node.js event loop. The maintainer characterizes the attack vector as local because the documented JSONC input is locally owned or user-controlled configuration, rather than input intended for the open internet. This JSONC-only scope does not include the plain JSON parser, which advances through and discards consumed string and number data. This issue is fixed in version 3.6.0.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-407"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104182.json"
}
References

Affected packages

Git / github.com/uhop/stream-json

Affected ranges

Type
GIT
Repo
https://github.com/uhop/stream-json
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
c0299dc168ce9455ef5ca5b6a0f6850ee7fa0468
Fixed
77a49460ed92e2f1843fb52305da739e0ef368cc
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "3.6.0"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.0.1
0.0.2
0.0.3
0.0.4
0.0.5
0.1.0
0.2.0
0.2.1
0.2.2
0.3.0
0.4.1
0.4.2
0.5.0
0.5.1
0.5.2
0.5.3
0.6.0
0.6.1
1.*
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.2.0
1.2.1
1.3.0
1.3.1
1.3.2
1.3.3
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.7.0
1.7.1
1.7.2
1.7.3
1.7.4
1.7.5
1.8.0
1.9.0
2.*
2.0.0
2.1.0
3.*
3.0.0
3.1.0
3.2.0
3.3.0
3.4.0
3.5.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104182.json"