Back to the CVE list

CVE-2026-114129

stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service

CVSS score

6.2

EPSS probability

—

Risk score

0.6

Published

4 h ago

Overview Public Exploits (0)Newsroom Vulnerability Timeline

Related Security News

Articles and analysis bulletins in which the press and security publications have covered this vulnerability:

No verified news item has been matched to this CVE yet.

Similar Vulnerabilities

5.1

CVE-2026-104183stream-json: Prototype pollution: Assembler writes this.current[this.key] on plain objects

Vendoruhop Productstream-json+2 etkilenen

Patch status unknownEPSS %020 d ago

6.2

CVE-2026-71430node-re2: String.prototype.replace(re2, template) aborts the Node process (uncatchable ToLocalChecked on empty MaybeLocal) when the result exceeds V8's max string length

Vendoruhop Productnode-re2+2 etkilenen

Patch verifiedEPSS %02 mo ago

5.1

CVE-2026-71498node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript

Vendoruhop Productnode-re2+2 etkilenen

Patch verifiedEPSS %02 mo ago

6.2

CVE-2026-104182stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk

Vendoruhop Productstream-json+2 etkilenen

Patch status unknownEPSS %020 d ago

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free key Documentation

curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-114129"

CVE-2026-114129 · stream-json: FlexAssembler string/RegExp…