Serialize JavaScript to a superset of JSON that includes regular expressions and functions. Prior to version 7.0.5, there is a Denial of Service (DoS) vulnerability caused by CPU exhaustion. When serializing a specially crafted "array-like" object (an object that inherits from Array.prototype but has a very large length property), the process enters an intensive loop that consumes 100% CPU and hangs indefinitely. This issue has been patched in version 7.0.5.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-21286 advisory.

    [8.0.128-1.0.1]
    - Add support for Oracle Linux

    [8.0.128-1]
    - Update to .NET SDK 8.0.128 and Runtime 8.0.28
    - Resolves: RHEL-181056

    [8.0.127-1]
    - Update to .NET SDK 8.0.127 and Runtime 8.0.27
    - Resolves: RHEL-173924

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1276:12 advisory.

    * serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object     serialization (CVE-2026-34043)
      * dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-21293 advisory.

    [8.0.128-1.0.1]
    - Add support for Oracle Linux

    [8.0.128-1]
    - Update to .NET SDK 8.0.128 and Runtime 8.0.28
    - Resolves: RHEL-181055

    [8.0.127-1]
    - Update to .NET SDK 8.0.127 and Runtime 8.0.27
    - Resolves: RHEL-173923

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:24332 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 8.0.127 and .NET Runtime 8.0.27.Security Fix(es):

    * serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object     serialization (CVE-2026-34043)

    * dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:24335 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 8.0.127 and .NET Runtime 8.0.27.Security Fix(es):

    * serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object     serialization (CVE-2026-34043)

    * dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:24334 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 8.0.127 and .NET Runtime 8.0.27.Security Fix(es):

    * serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object     serialization (CVE-2026-34043)

    * dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:21286 advisory.

    * serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object     serialization (CVE-2026-34043)

    * dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-756:09 advisory.

    * serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object     serialization (CVE-2026-34043)
      * dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:21293 advisory.

    * serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object     serialization (CVE-2026-34043)

    * dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:21291 advisory.

    * serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object     serialization (CVE-2026-34043)

    * dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:21291 advisory.

    * serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object     serialization (CVE-2026-34043)
      * dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:21293 advisory.

    * serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object     serialization (CVE-2026-34043)
      * dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:21286 advisory.

    * serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object     serialization (CVE-2026-34043)
      * dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-21291 advisory.

    [8.0.127-1.0.1]
    - Add support for Oracle Linux

    [8.0.127-1]
    - Update to .NET SDK 8.0.127 and Runtime 8.0.27
    - Resolves: RHEL-173920

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:21293 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 8.0.127 and .NET Runtime 8.0.27.Security Fix(es):

    * serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object     serialization (CVE-2026-34043)

    * dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:21291 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 8.0.127 and .NET Runtime 8.0.27.Security Fix(es):

    * serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object     serialization (CVE-2026-34043)

    * dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:21286 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 8.0.127 and .NET Runtime 8.0.27.Security Fix(es):

    * serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object     serialization (CVE-2026-34043)

    * dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Serialize JavaScript to a superset of JSON that includes regular expressions and functions. Prior to     version 7.0.5, there is a Denial of Service (DoS) vulnerability caused by CPU exhaustion. When serializing     a specially crafted array-like object (an object that inherits from Array.prototype but has a very large     length property), the process enters an intensive loop that consumes 100% CPU and hangs indefinitely. This     issue has been patched in version 7.0.5. (CVE-2026-34043)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Serialize JavaScript to a superset of JSON that includes regular expressions and functions. Prior to
    version 7.0.5, there is a Denial of Service (DoS) vulnerability caused by CPU exhaustion. When serializing
    a specially crafted "array-like" object (an object that inherits from Array.prototype but has a very large
    length property), the process enters an intensive loop that consumes 100% CPU and hangs indefinitely. This
    issue has been patched in version 7.0.5. (CVE-2026-34043)

ID	Name	Product	Family	Type	Severity
329242	Oracle Linux 10 : .NET / 8.0 (ELSA-2026-21286)	Nessus	Oracle Linux Local Security Checks	Local	high
328452	MiracleLinux 9 : dotnet8.0-8.0.127-1.el9_8.ML.1 (AXSA:2026-1276:12)	Nessus	Miracle Linux Local Security Checks	Local	high
323117	Oracle Linux 9 : .NET / 8.0 (ELSA-2026-21293)	Nessus	Oracle Linux Local Security Checks	Local	high
319653	RHEL 10 : .NET 8.0 (RHSA-2026:24332)	Nessus	Red Hat Local Security Checks	Local	high
319646	RHEL 9 : .NET 8.0 (RHSA-2026:24335)	Nessus	Red Hat Local Security Checks	Local	high
319642	RHEL 9 : .NET 8.0 (RHSA-2026:24334)	Nessus	Red Hat Local Security Checks	Local	high
318649	RockyLinux 10 : .NET 8.0 (RLSA-2026:21286)	Nessus	Rocky Linux Local Security Checks	Local	high
318592	MiracleLinux 8 : dotnet8.0-8.0.127-1.el8_10.ML.1 (AXSA:2026-756:09)	Nessus	Miracle Linux Local Security Checks	Local	high
318040	RockyLinux 9 : .NET 8.0 (RLSA-2026:21293)	Nessus	Rocky Linux Local Security Checks	Local	high
317498	RockyLinux 8 : .NET 8.0 (RLSA-2026:21291)	Nessus	Rocky Linux Local Security Checks	Local	high
317454	AlmaLinux 8 : .NET 8.0 (ALSA-2026:21291)	Nessus	Alma Linux Local Security Checks	Local	high
317453	AlmaLinux 9 : .NET 8.0 (ALSA-2026:21293)	Nessus	Alma Linux Local Security Checks	Local	high
317451	AlmaLinux 10 : .NET 8.0 (ALSA-2026:21286)	Nessus	Alma Linux Local Security Checks	Local	high
317450	Oracle Linux 8 : .NET / 8.0 (ELSA-2026-21291)	Nessus	Oracle Linux Local Security Checks	Local	high
317109	RHEL 9 : .NET 8.0 (RHSA-2026:21293)	Nessus	Red Hat Local Security Checks	Local	high
317107	RHEL 8 : .NET 8.0 (RHSA-2026:21291)	Nessus	Red Hat Local Security Checks	Local	high
317105	RHEL 10 : .NET 8.0 (RHSA-2026:21286)	Nessus	Red Hat Local Security Checks	Local	high
304465	Linux Distros Unpatched Vulnerability : CVE-2026-34043	Nessus	Misc.	Local	high
439361	SCA: security update for serialize-javascript (GHSA-qj8w-gfj5-8c6v)	Tenable Cloud Security	SCA Checks	Local	high
439361	SCA: security update for serialize-javascript (GHSA-qj8w-gfj5-8c6v)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-34043

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high