# What changed in stream-json

> 4 changes in stream-json 3 from its official release notes, upgrade guides and advisories: 4 security. Each one cited. Sources checked 2026-10-27. HTML: https://unstale.sh/npm/stream-json/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## stream-json 3

### Security

- stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service (3.7.0) — [security advisory](https://github.com/advisories/GHSA-JJ87-HC4R-JWFW)
- stream-json has a prototype pollution issue: Assembler writes this.current[this.key] on plain objects (3.6.0) — [security advisory](https://github.com/advisories/GHSA-MJW6-4JJ6-33HC)
- stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk (3.6.0) — [security advisory](https://github.com/advisories/GHSA-HQR4-QQ8F-HG3X)
- stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS) (3.5.0) — [security advisory](https://github.com/advisories/GHSA-528H-PC64-C93X)