THREAT OPS › Threat News › [GHSA] GHSA-528h-pc64-c93x (medium) — stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)
[GHSA] GHSA-528h-pc64-c93x (medium) — stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)
GHSA-528h-pc64-c93x Severity: medium CVE: CVE-2026-71429
stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)
## Description
The path filters `pick`, `ignore`, `filter`, and `replace` — the library's headline "surgical extraction" feature — recompute the full path string from the nesting stack on **eve
Indicators of compromise
- CVE-2026-71429cve
Original source: https://github.com/advisories/GHSA-528h-pc64-c93x