{"id":"CVE-2026-116581","kind":"vulnerability","aliases":["CVE-2026-116581"],"related":[],"title":"Seroval: crafted input creates endless iterator, hanging services that deserialize it","description":"Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON and fromCrossJSON do not validate a sequence node's done index. A crafted done index can create an iterator that never finishes when application code consumes it to completion. An unauthenticated request to a service that deserializes untrusted input can therefore block the event loop, exhaust process memory, or make the service unavailable. This issue is fixed in version 1.6.8.","summary":"Seroval is a JavaScript library that serializes and deserializes values beyond what JSON.stringify supports. Before 1.6.8, fromJSON and fromCrossJSON did not check a sequence node's done index, so crafted input can create an iterator that never finishes, blocking the event loop or exhausting memory.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["javascript","node.js","package","self-hosted"],"not_affected_if":["no-untrusted-deserialization","seroval-not-installed"],"how_to_check":"- Run `npm ls seroval` to see which installed versions of seroval are present.\n- Check whether application code calls fromJSON or fromCrossJSON on untrusted input.","fix":"- Upgrade seroval to `1.6.8` or later.","status":"open","published_at":"2026-10-26T21:18:15+00:00","first_seen_at":"2026-10-26T21:20:31+00:00","triaged_at":"2026-10-26T21:21:09+00:00","updated_at":"2026-10-26T21:21:09+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-26T21:21:09Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade seroval to `1.6.8` or later.","reach":"internet","title":"Seroval: crafted input creates endless iterator, hanging services that deserialize it","impact":"medium","summary":"Seroval is a JavaScript library that serializes and deserializes values beyond what JSON.stringify supports. Before 1.6.8, fromJSON and fromCrossJSON did not check a sequence node's done index, so crafted input can create an iterator that never finishes, blocking the event loop or exhausting memory.","category":"package","nicknames":[],"who_cares":["javascript","node.js","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Unauthenticated requests can hang the service and exhaust process memory.","analyst_note":"Check the NVD entry and the seroval 1.6.8 release or commit to confirm which frameworks depend on seroval and whether the advisory lists a CWE and affected version range.","how_to_check":"- Run `npm ls seroval` to see which installed versions of seroval are present.\n- Check whether application code calls fromJSON or fromCrossJSON on untrusted input.","needs_analyst":true,"not_affected_if":["no-untrusted-deserialization","seroval-not-installed"],"who_is_affected":"Applications that use seroval versions before 1.6.8 to deserialize data from untrusted sources, such as request bodies, are exposed. Applications that only serialize their own trusted data, or that do not use seroval, can skip it. The sources do not say which frameworks bundle seroval.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000624,"input_tokens":3384,"output_tokens":572,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116581':13A,16A '-2026':12A,15A '1.6.8':38B,81C,142C 'applic':106C 'beyond':33B,76C 'block':61B,124C 'capabl':78C 'check':44B 'code':107C 'complet':111C 'complex':74C 'consum':108C 'craft':2A,52B,95C 'creat':4A,55B,99C 'cve':11A,14A 'deseri':10A,31B,119C 'done':49B,92C,96C 'endless':5A 'event':63B,126C 'exhaust':66B,128C 'facilit':69C 'finish':60B,104C 'fix':139C 'fromcrossjson':41B,84C 'fromjson':39B,82C 'hang':7A 'host':22B 'includ':73C 'index':50B,93C,97C 'input':3A,53B,121C 'issu':137C 'iter':6A,57B,101C 'javascript':17B,26B,70C 'json.stringify':35B,77C 'librari':27B 'loop':64B,127C 'make':132C 'memori':67B,130C 'never':59B,103C 'node':47B,90C 'node.js':18B 'packag':19B 'prior':79C 'process':129C 'request':114C 'self':21B 'self-host':20B 'sequenc':46B,89C 'serial':29B 'serov':1A,23B,68C 'servic':8A,117C,134C 'stringif':72C 'structur':75C 'support':36B 'therefor':123C 'unauthent':113C 'unavail':135C 'untrust':120C 'valid':87C 'valu':32B,71C 'version':141C","nicknames":[],"mitigations":[],"who_affected":"Applications that use seroval versions before 1.6.8 to deserialize data from untrusted sources, such as request bodies, are exposed. Applications that only serialize their own trusted data, or that do not use seroval, can skip it. The sources do not say which frameworks bundle seroval.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:18:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116581","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116581","severity":null,"published_at":"2026-10-26T21:18:15+00:00","modified_at":"2026-10-26T21:18:16+00:00","first_seen_at":"2026-10-26T21:20:31+00:00","fetched_at":"2026-10-26T21:20:31+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}