stream-json ^1.7.3 has no non-vulnerable resolution (CVE-2026-71429 / GHSA-528h-pc64-c93x)

[ggrizzly]

[REQUIRED] Environment info

firebase-tools:
15.29.0 (latest; also reproduces on 15.22.1, 15.0.0, 14.0.0, 13.0.0)

Platform:
macOS 26.5.2 (arm64), node v26.5.0 / npm 11.17.0
also reproduces on ubuntu-latest with node 22.22.3 in CI

[REQUIRED] Test case

  mkdir fb-repro && cd fb-repro
  npm init -y
  npm i firebase-tools@15.29.0
  npm audit --omit=dev

[REQUIRED] Steps to reproduce

1. Install firebase-tools (any version — see below) into a clean project.
2. Run npm audit --omit=dev.

[REQUIRED] Expected behavior

A clean install of the latest firebase-tools has a remediation path for known advisories in its dependency tree i.e. npm audit either passes, or npm audit fix resolves it without a breaking downgrade.

[REQUIRED] Actual behavior

npm audit reports a moderate advisory with no non-breaking remediation:

stream-json  <=3.4.0
Severity: moderate
stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input —
small crafted JSON blocks the event loop for seconds→minutes (DoS)
- https://github.com/advisories/GHSA-528h-pc64-c93x
fix available via `npm audit fix --force`
Will install firebase-tools@10.1.1, which is a breaking change
node_modules/stream-json

The root cause:
firebase-tools declares stream-json: ^1.7.3 and resolves to 1.9.1.
CVE-2026-71429 / GHSA-528h-pc64-c93x affects stream-json <= 3.4.0, so every version resolvable under ^1.7.3 is affected.

There are no patched releases inside the declared range. The only fixed versions are 3.5.0 and 3.6.0, which break firebase-tools.

^1.7.3 is the declared range on every version I sampled: 13.0.0, 14.0.0, 15.0.0, 15.10.0, 15.20.0, 15.22.1, 15.26.0, 15.28.0 and 15.29.0 (latest).

This blocks CI for anyone whose pipeline gates on npm audit, with no available remediation.

The obvious fix of npm audit fix will silently break the CLI. Overriding to stream-json@^3.6.0 will install cleanly and firebase --version will still print correctly, but 3.x moved its subpath exports, and four of the five entry points firebase-tools requires fail to resolve:

node -e "require('stream-json')"                          # OK
node -e "require('stream-json/filters/Filter')"           # MODULE_NOT_FOUND
node -e "require('stream-json/filters/Pick')"             # MODULE_NOT_FOUND
node -e "require('stream-json/streamers/StreamArray')"    # MODULE_NOT_FOUND
node -e "require('stream-json/streamers/StreamObject')"   # MODULE_NOT_FOUND

Call sites:
lib/commands/auth-import.js, lib/database/import.js, lib/frameworks/next/index.js. The failure only surfaces when one of those paths runs, so an override ships looking healthy and breaks later. It took down a deploy as it hit exactly this basically.

So the bump to ^3.5.0 needs the import paths updated alongside it.

No one seemed to have reported this with regards to CVE-2026-71429 / GHSA-528h-pc64-c93x so I figured it's a non-dupe.

[aalej]

Thanks for reporting this @ggrizzly! As you mentioned, to resolve this issue we would need to bump the version of stream-json as well as to update the import paths. There does seem to be a few breaking changes from stream-json: ^1.7.3 and the latest version(v3.6.0). I'll raise this to our engineering team.

[ggrizzly]

@aalej appreciate it!

[ggrizzly]

Just as a heads up @joehan / @aalej - there's a second associated CVE that's likely related:

[ERROR] npm vulnerabilities found in scripts/firebase-deploy:
  csv-parse: node-csv: Prototype replacement still reachable via columns path (GHSA-8cw4-87c7-c6xx)

firebase-tools@15.22.1 has a direct dependency with csv-parse: ^5.0.4 (resolved to 5.6.0).
Advisory GHSA-8cw4-87c7-c6xx flags prototype pollution affecting all versions <7.0.2, and the npm audit fix proposes downgrading five major versions back to firebase-tools@10.1.1, which we are unwilling to do / will break our CI.

[diegopittom-jpg]

Hi @joehan — adding one affected-user data point from our side.

Our CI gates merges on npm audit --audit-level=moderate, so this currently blocks our merge pipeline entirely.

We also checked firebase-tools@15.30.0, released yesterday, and it still declares stream-json ^1.7.3 and csv-parse ^5.0.4, so upgrading does not provide a remediation path for either advisory yet.

If there is an internal or public tracking PR or branch for these dependency migrations, a pointer would be very helpful.

Thanks for looking into this.

[joehan]

Hey @diegopittom-jpg, this is the best place to track the fix for now. An engineer from our team should get to this soon, and I'd expect the fix to be ready for the next release

[joehan]

Quick note - we ended up deciding to do an extra, early release this week, so this will not be fixed in todays release. Still planned to get a fix out soon.

[ggrizzly]

@joehan wanted to check in on this.