{"id":"CVE-2026-116584","kind":"vulnerability","aliases":["CVE-2026-116584"],"related":[],"title":"Seroval: crafted JSON payload exhausts memory and blocks the thread","description":"Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.4.1 until 1.6.8, fromJSON and fromCrossJSON do not require an array node's element list to be an actual array. A small crafted payload can supply an attacker-controlled length that determines memory allocation and decoder iterations independently of payload size, allowing an unauthenticated request to exhaust the process or block its thread. This issue is a residual bypass of the remediation for CVE-2026-23957. This issue is fixed in version 1.6.8.","summary":"Seroval's fromJSON and fromCrossJSON decoders accept an array node whose element list is not a real array, so a small payload can set a large length that drives memory allocation and loop count. An unauthenticated request can exhaust the process or block its event loop, causing a denial of service.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["javascript","node","package","seroval","server-functions","solid","tanstack-start"],"not_affected_if":["no-untrusted-input","version-outside-range"],"how_to_check":"- Check the installed version: `npm ls seroval` (or `pnpm why seroval`, `yarn why seroval`) and look for any version from `1.4.1` up to but not including `1.6.8`.\n- Check whether your application deserializes untrusted input with `fromJSON` or `fromCrossJSON` from seroval, for example in server functions or RPC endpoints.","fix":"- Upgrade seroval to `1.6.8` or later, including transitive copies pulled in by frameworks.\n- Rebuild and redeploy the server so the bundled copy is replaced.","status":"open","published_at":"2026-10-26T21:18:17+00:00","first_seen_at":"2026-10-26T21:20:32+00:00","triaged_at":"2026-10-26T21:21:10+00:00","updated_at":"2026-10-26T21:21:10+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T21:21:10Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade seroval to `1.6.8` or later, including transitive copies pulled in by frameworks.\n- Rebuild and redeploy the server so the bundled copy is replaced.","reach":"internet","title":"Seroval: crafted JSON payload exhausts memory and blocks the thread","impact":"medium","summary":"Seroval's fromJSON and fromCrossJSON decoders accept an array node whose element list is not a real array, so a small payload can set a large length that drives memory allocation and loop count. An unauthenticated request can exhaust the process or block its event loop, causing a denial of service.","category":"package","nicknames":[],"who_cares":["javascript","node","seroval","server-functions","tanstack-start","solid"],"confidence":0.6,"needs_auth":"no","worst_case":"Unauthenticated requests exhaust server memory or block the process thread","analyst_note":"Check the NVD entry and the seroval 1.6.8 release for the affected endpoints and whether any framework bundles the vulnerable decoder; the sources did not name affected frameworks.","how_to_check":"- Check the installed version: `npm ls seroval` (or `pnpm why seroval`, `yarn why seroval`) and look for any version from `1.4.1` up to but not including `1.6.8`.\n- Check whether your application deserializes untrusted input with `fromJSON` or `fromCrossJSON` from seroval, for example in server functions or RPC endpoints.","needs_analyst":true,"not_affected_if":["no-untrusted-input","version-outside-range"],"who_is_affected":"Applications that pass untrusted request data into seroval's fromJSON or fromCrossJSON decoders are exposed, since the flaw is reachable without authentication. Projects that only serialize their own data, or that never receive seroval payloads from clients, are less exposed. Teams running pinned versions outside the affected range can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000685,"input_tokens":3407,"output_tokens":689,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116584':13A,16A '-2026':12A,15A,156C '-23957':157C '1.4.1':91C '1.6.8':93C,164C 'accept':34B 'actual':109C 'alloc':58B,125C 'allow':133C 'array':36B,45B,101C,110C 'attack':119C 'attacker-control':118C 'beyond':87C 'block':8A,70B,142C 'bypass':150C 'capabl':89C 'caus':74B 'complex':85C 'control':120C 'count':61B 'craft':2A,113C 'cve':11A,14A,155C 'decod':33B,127C 'denial':76B 'determin':123C 'drive':56B 'element':39B,104C 'event':72B 'exhaust':5A,66B,138C 'facilit':80C 'fix':161C 'fromcrossjson':32B,96C 'fromjson':30B,94C 'function':23B 'includ':84C 'independ':129C 'issu':146C,159C 'iter':128C 'javascript':17B,81C 'json':3A 'json.stringify':88C 'larg':53B 'length':54B,121C 'list':40B,105C 'loop':60B,73B 'memori':6A,57B,124C 'node':18B,37B,102C 'packag':19B 'payload':4A,49B,114C,131C 'process':68B,140C 'real':44B 'remedi':153C 'request':64B,136C 'requir':99C 'residu':149C 'serov':1A,20B,28B,79C 'server':22B 'server-funct':21B 'servic':78B 'set':51B 'size':132C 'small':48B,112C 'solid':24B 'start':27B 'stringif':83C 'structur':86C 'suppli':116C 'tanstack':26B 'tanstack-start':25B 'thread':10A,144C 'unauthent':63B,135C 'valu':82C 'version':163C 'whose':38B","nicknames":[],"mitigations":[],"who_affected":"Applications that pass untrusted request data into seroval's fromJSON or fromCrossJSON decoders are exposed, since the flaw is reachable without authentication. Projects that only serialize their own data, or that never receive seroval payloads from clients, are less exposed. Teams running pinned versions outside the affected range can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:18:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116584","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116584","severity":null,"published_at":"2026-10-26T21:18:17+00:00","modified_at":"2026-10-26T21:18:17+00:00","first_seen_at":"2026-10-26T21:20:32+00:00","fetched_at":"2026-10-26T21:20:32+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}