CVE-2026-116581

Seroval: fromJSON deserializer trusts sequence doneAt (unauthenticated event-loop DoS)

State: Published
Severity: 7.5 High
Published: Oct 26, 2026
Updated: Oct 26, 2026
Reserved: Oct 26, 2026

Description

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON and fromCrossJSON do not validate a sequence node's done index. A crafted done index can create an iterator that never finishes when application code consumes it to completion. An unauthenticated request to a service that deserializes untrusted input can therefore block the event loop, exhaust process memory, or make the service unavailable. This issue is fixed in version 1.6.8.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	GitHub_M

Weaknesses

CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
CWE-1284 Improper Validation of Specified Quantity in Input

Affected Products

Product	Versions
serovallxsmnsyc	< 1.6.8Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.