CVE-2026-116581 Details
Description
Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON and fromCrossJSON do not validate a sequence node's done index. A crafted done index can create an iterator that never finishes when application code consumes it to completion. An unauthenticated request to a service that deserializes untrusted input can therefore block the event loop, exhaust process memory, or make the service unavailable. This issue is fixed in version 1.6.8.
A denial-of-service vulnerability has been identified in Seroval versions prior to 1.6.8. The issue arises in the 'fromJSON' and 'fromCrossJSON' deserialization methods, which fail to validate specific sequence node indices. This lack of validation allows for the creation of an iterator that never completes, potentially blocking the event loop, exhausting process memory, or causing service unavailability. The vulnerability can be exploited through an unauthenticated request that sends untrusted input to a service that deserializes it.
Users are advised to upgrade to Seroval version 1.6.8 or later, where this vulnerability has been fixed. The updated version includes proper validation of sequence indices during deserialization, ensuring that indices are integers within the correct range.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 26, 2026CISA-ADP
Assessed Oct 31, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/lxsmnsyc/seroval/commit/e176f9267e59ddd6c9de89cc9fe85c5b37a5b728 | [email protected] | Source CodeVendor |
| https://github.com/lxsmnsyc/seroval/releases/tag/[email protected] | [email protected] | Source CodeVendor |
| https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-97r2-qh9m-474h | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1284 | Improper Validation of Specified Quantity in Input | [email protected] |
| CWE-835 | Loop with Unreachable Exit Condition ('Infinite Loop') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| lxsmnsyc Seroval | <= 1.6.7 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 31, 2026 | CVE Modified | CISA-ADP |
| Oct 26, 2026 | New CVE Received | [email protected] |