The stream-json library's Assembler component prior to version 3.6.0 improperly handles input keys named __proto__ by invoking the inherited setter, causing the replacement of the parsed object's prototype rather than creating an own property. This prototype pollution can affect applications that rely on inherited values for authorization or feature decisions, or that expect Object.prototype methods to be intact. The global Object.prototype is not affected, and the maintainer notes that typical inputs are local dumps or logs, characterizing the attack vector as local. The vulnerability is resolved in version 3.6.0.

This vulnerability allows modification of an object's prototype within the stream-json library, potentially enabling attackers to influence application behavior by injecting properties via the prototype chain. This can lead to incorrect authorization or feature decisions and disrupt code relying on standard Object.prototype methods. However, the global Object.prototype is not polluted, and the attack vector is considered local rather than remote.

Upgrade to stream-json version 3.6.0 or later, where this prototype pollution vulnerability is fixed. Since the maintainer characterizes the attack vector as local and typical inputs as locally owned dumps or logs, ensure that untrusted JSON inputs are not processed without validation. No other specific mitigations are indicated.