Live › vulnerability › CVE-2026-116581
Go to dashboardSeroval is a JavaScript library that serializes and deserializes values beyond what JSON.stringify supports. Before 1.6.8, fromJSON and fromCrossJSON did not check a sequence node's done index, so crafted input can create an iterator that never finishes, blocking the event loop or exhausting memory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 21:20 UTC. All times on this page are UTC.
Applications that use seroval versions before 1.6.8 to deserialize data from untrusted sources, such as request bodies, are exposed. Applications that only serialize their own trusted data, or that do not use seroval, can skip it. The sources do not say which frameworks bundle seroval.
No product ranges from the sources yet.
npm ls seroval to see which installed versions of seroval are present.1.6.8 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON and fromCrossJSON do not validate a sequence node's done index. A crafted done index can create an iterator that never finishes when application code consumes it to completion. An unauthenticated request to a service that deserializes untrusted input can therefore block the event loop, exhaust process memory, or make the service unavailable. This issue is fixed in version 1.6.8.
This page as .md · .json · in your agent: get_signal("CVE-2026-116581")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.