CVE-2026-114129: stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service

FlexAssembler, the custom-container assembler shipped in the stream-json package (src/core/utils/flex-assembler.js, re-exported at stream-json/utils/flex-assembler.js and stream-json/web/utils/flex-assembler.js), compiles a string or RegExp path filter into a matcher that runs keyStack.join(separator) on every container start. Because the key stack grows one entry per open object or array with no depth bound, a JSON document nested to depth D drives D container-start tokens that each perform an O(D) join, for O(D^2) total CPU on the single-threaded event loop. An unauthenticated party who can supply JSON bytes to a pipeline that uses a FlexAssembler with a string or RegExp rule filter can stall the process with a small input: roughly 96 KB (depth 16000) blocks the event loop for over a second, and the cost grows quadratically.