CVE-2026-114129: CWE-407: Inefficient Algorithmic Complexity in uhop stream-json

The vulnerability arises because FlexAssembler compiles path filters into matchers that join the entire key stack on each container start. Since the key stack grows with unbounded nesting depth, processing a document nested to depth D results in D join operations, each costing more as depth increases, leading to quadratic CPU usage. This inefficiency can be exploited by an attacker supplying a crafted deeply nested JSON document to stall all concurrent processing in the affected process. The flaw affects versions >=2.0.0 and <3.7.0 of the stream-json library. The fix in 3.7.0 introduces a default maximum depth to prevent unbounded nesting from causing excessive CPU load.

The vulnerability causes high CPU consumption on the single-threaded event loop, leading to denial of service by stalling all concurrent work in a process that feeds crafted deeply nested JSON documents to the affected FlexAssembler. There is no impact on confidentiality or integrity. The attack does not require knowledge of the target schema and affects only consumers using string or regex path filters, not those using function filters or no rules.

Upgrade to stream-json version 3.7.0 or later, which fixes the issue by adding a default maximum depth limit to prevent excessive CPU consumption. No other mitigations are indicated. Since this is a library vulnerability, users should update their dependencies accordingly.