---
id: CVE-2026-116581
aliases:
  - GHSA-97r2-qh9m-474h
title: >-
  Seroval: fromJSON deserializer trusts node-supplied array length and sequence
  doneAt (unauthenticated event-loop DoS)
summary: >-
  Seroval: fromJSON deserializer trusts node-supplied array length and sequence
  doneAt (unauthenticated event-loop DoS)
severity: high
cvss: 7.5
cwe:
  - CWE-835
  - CWE-1284
vendor: seroval
product: seroval
ecosystem: npm
affected:
  - seroval <= 1.6.7
patched:
  - seroval 1.6.8
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T21:17:28Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-97r2-qh9m-474h'
references:
  - url: >-
      https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-97r2-qh9m-474h
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-116581'
  - url: >-
      https://github.com/lxsmnsyc/seroval/commit/cdcee3e3bc384ee844360844f8ea98fd2b275d69
  - url: >-
      https://github.com/lxsmnsyc/seroval/commit/e176f9267e59ddd6c9de89cc9fe85c5b37a5b728
  - url: 'https://github.com/lxsmnsyc/seroval/releases/tag/seroval@1.6.8'
  - url: 'https://github.com/advisories/GHSA-97r2-qh9m-474h'
tags:
  - ghsa
  - npm
  - cve.org
epss: 0.00451
epssPercentile: 0.39075
ingestedAt: '2026-10-27T16:11:59.027Z'
---

## Overview

### Summary

`fromJSON` and `fromCrossJSON` used two node fields without checking them.

- An array node's element list was not checked to be an array. A small payload could set the length the decoder looped over. This part is also tracked in GHSA-wp97-x4hv-qvhp.
- A sequence node's done index was not checked. A crafted value produced an iterator that never finished.

### Impact

A service that passes untrusted input to `fromJSON` or `fromCrossJSON` can be made unavailable by an unauthenticated request.

- The array case blocks the thread while the decoder runs.
- The sequence case makes any code that reads the resulting iterator to the end run forever.

### Patches

Fixed in `seroval@1.6.8`.

- Element lists must be arrays.
- A sequence node's throw and done indices must be integers from -1 up to the last element index.

Invalid input throws `SerovalMalformedNodeError`.

### Workarounds

None. Upgrade to 1.6.8.

## Affected packages

- `seroval <= 1.6.7`

## Remediation

Upgrade to a patched release:

- `seroval 1.6.8`