CVE-2026-116584High· 7.5▾ TwilightSeroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 27.
Disclosure to exploitation, from the record and what we observed since indexing it.
0.4%
Disclosed via GHSA
fromJSON and fromCrossJSON did not check that an array node's element list is an array. A small crafted payload could set the length the decoder used. That length controlled how much memory was allocated and how many times the decoder looped, and it did not depend on the size of the payload.
A service that passes untrusted input to fromJSON or fromCrossJSON can be made unavailable by an unauthenticated request.
This affects any framework that decodes request bodies with these functions before its own validation runs.
This issue is a bypass of the fix for GHSA-66fc-rw6m-c2q6 in 1.4.1.
Fixed in [email protected]. The deserializer now rejects any node whose element list is not an array, and throws SerovalMalformedNodeError.
None. Upgrade to 1.6.8.
seroval >= 1.4.1, <= 1.6.7Upgrade to a patched release:
seroval 1.6.8Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116581High· 7.5Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS)
CVE-2026-116580High· 7.3Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check
CVE-2026-104845High· 7.5Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities
CVE-2026-116583Medium· 5.3Seroval: Code injection through a typed array's own constructor property
CVE-2026-116582Medium· 4.7Seroval: Script injection through RegExp sources in serialized output
CVE-2026-104846Critical· 9.8Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities