Live › vulnerability › CVE-2026-116584
Go to dashboardSeroval's fromJSON and fromCrossJSON decoders accept an array node whose element list is not a real array, so a small payload can set a large length that drives memory allocation and loop count. An unauthenticated request can exhaust the process or block its event loop, causing a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 21:20 UTC. All times on this page are UTC.
Applications that pass untrusted request data into seroval's fromJSON or fromCrossJSON decoders are exposed, since the flaw is reachable without authentication. Projects that only serialize their own data, or that never receive seroval payloads from clients, are less exposed. Teams running pinned versions outside the affected range can skip it.
No product ranges from the sources yet.
npm ls seroval (or pnpm why seroval, yarn why seroval) and look for any version from 1.4.1 up to but not including 1.6.8.fromJSON or fromCrossJSON from seroval, for example in server functions or RPC endpoints.1.6.8 or later, including transitive copies pulled in by frameworks.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.4.1 until 1.6.8, fromJSON and fromCrossJSON do not require an array node's element list to be an actual array. A small crafted payload can supply an attacker-controlled length that determines memory allocation and decoder iterations independently of payload size, allowing an unauthenticated request to exhaust the process or block its thread. This issue is a residual bypass of the remediation for CVE-2026-23957. This issue is fixed in version 1.6.8.
This page as .md · .json · in your agent: get_signal("CVE-2026-116584")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.