The vulnerability CVE-2026-41146 affects facil.io versions prior to commit 5128747363055201d3ecf0e29bf0a961703c9fa0. The JSON parser function `fio_json_parse` can enter an infinite loop when encountering nested JSON values starting with 'i' or 'I', causing uncontrolled resource consumption by pegging one CPU core at 100%. This behavior results from the parser tolerating missing commas and misinterpreting trailing 'i' characters as new values, leading to a spin in user space rather than a parse error. The iodine project, which vendors the same parser code, is also affected. The issue is resolved by the referenced commit, but no explicit vendor advisory or patch link is provided.

An attacker can cause a denial of service by sending specially crafted JSON input that triggers an infinite loop in the parser, resulting in high CPU usage and potential service disruption. The vulnerability does not require authentication or user interaction and can be triggered remotely via network access to the affected parser. There are no known exploits in the wild at this time.

A fix for this vulnerability is available in commit 5128747363055201d3ecf0e29bf0a961703c9fa0 of facil.io. Users should upgrade to a version that includes this commit to remediate the issue. Since no official vendor advisory or patch link is provided, users should monitor the facil.io project repository or vendor communications for an official release containing this fix. Until patched, consider restricting or validating JSON input to avoid nested values starting with 'i' or 'I' if feasible.