Detections
Analytics
CVE-2026-116581
high
Description
Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON and fromCrossJSON do not validate a sequence node's done index. A crafted done index can create an iterator that never finishes when application code consumes it to completion. An unauthenticated request to a service that deserializes untrusted input can therefore block the event loop, exhaust process memory, or make the service unavailable. This issue is fixed in version 1.6.8.
References
https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-97r2-qh9m-474h
https://github.com/lxsmnsyc/seroval/releases/tag/[email protected]
https://github.com/lxsmnsyc/seroval/commit/e176f9267e59ddd6c9de89cc9fe85c5b37a5b728