CVE-2026-104183: stream-json has a prototype pollution issue: Assembler writes this.current[this.key] on plain objects

October 5, 2026

A prototype-pollution vulnerability in stream-json lets attacker-controlled JSON replace a parsed object’s prototype.

References

github.com/advisories/GHSA-mjw6-4jj6-33hc
github.com/uhop/stream-json/commit/2f2d35bbb547306991ded6487a279154d865a358
github.com/uhop/stream-json/releases/tag/3.6.0
github.com/uhop/stream-json/security/advisories/GHSA-mjw6-4jj6-33hc
nvd.nist.gov/vuln/detail/CVE-2026-104183

Code Behaviors & Features

Detect and mitigate CVE-2026-104183 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →