CVE-2026-116584 Details
Description
Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.4.1 until 1.6.8, fromJSON and fromCrossJSON do not require an array node's element list to be an actual array. A small crafted payload can supply an attacker-controlled length that determines memory allocation and decoder iterations independently of payload size, allowing an unauthenticated request to exhaust the process or block its thread. This issue is a residual bypass of the remediation for CVE-2026-23957. This issue is fixed in version 1.6.8.
A denial-of-service vulnerability has been identified in the Seroval library, specifically in versions 1.4.1 prior to 1.6.8. The issue arises in the `fromJSON` and `fromCrossJSON` functions, which fail to validate that an array node's element list is a genuine array. This oversight allows a crafted payload to manipulate the length of the array, controlling memory allocation and the number of iterations in the decoder. As a result, an unauthenticated request can cause the process to exhaust its resources or block its thread, leading to unavailability. This vulnerability is a residual bypass of the previous remediation for CVE-2026-23957.
Users are advised to upgrade to Seroval version 1.6.8, where this vulnerability has been fixed by implementing proper validation of array node element lists during the deserialization process.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 26, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/lxsmnsyc/seroval/commit/cdcee3e3bc384ee844360844f8ea98fd2b275d69 | [email protected] | Source CodeVendor |
| https://github.com/lxsmnsyc/seroval/releases/tag/[email protected] | [email protected] | Source CodeVendor |
| https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-wp97-x4hv-qvhp | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| lxsmnsyc Seroval | >= 1.4.1, <= 1.6.7 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Oct 26, 2026 | New CVE Received | [email protected] |