Vulnerability Description
Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON and fromCrossJSON do not validate a sequence node's done index. A crafted done index can create an iterator that never finishes when application code consumes it to completion. An unauthenticated request to a service that deserializes untrusted input can therefore block the event loop, exhaust process memory, or make the service unavailable. This issue is fixed in version 1.6.8.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/lxsmnsyc/seroval/commit/e176f9267e59ddd6c9de89cc9fe85c5b37a5b
- https://github.com/lxsmnsyc/seroval/releases/tag/[email protected]
- https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-97r2-qh9m-474h
FAQ
What is CVE-2026-116581?
CVE-2026-116581 is a vulnerability with a CVSS score of 7.5 (HIGH). Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON and fromCrossJSON do not validate a sequence node's done...
How severe is CVE-2026-116581?
CVE-2026-116581 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-116581?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.