unstale

npm / stream-json

stream-json

What changed in stream-json 3, from its official release notes, upgrade guides and advisories. Also covers @types/stream-json. Sources checked 2026-10-27.

4 security

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli 0.2.8 on npm

stream-json 34 changes

Security 4

  • stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service

    3.7.0security advisory

  • stream-json has a prototype pollution issue: Assembler writes this.current[this.key] on plain objects

    3.6.0security advisory

  • stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk

    3.6.0security advisory

  • stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)

    3.5.0security advisory