CVE-2026-34043 Details

A denial-of-service vulnerability has been identified in Yahoo's serialize-javascript package, prior to version 7.0.5. This vulnerability is caused by CPU exhaustion when serializing specially crafted "array-like" objects that inherit from Array.prototype and possess a large length property. The serialization process enters a loop that consumes 100% CPU, causing the application to hang indefinitely. The issue can be exploited in applications that use serialize-javascript to serialize untrusted or user-controlled objects, particularly if the application is also vulnerable to Prototype Pollution or handles untrusted data through YAML Deserialization, as these could be used to inject the malicious object.

Users are advised to upgrade to version 7.0.5 or later. If an immediate upgrade is not possible, validate and sanitize all input before serialization, and ensure the environment is protected against Prototype Pollution.