---
id: "CVE-2026-116584"
kind: "vulnerability"
aliases: ["CVE-2026-116584"]
title: "Seroval: crafted JSON payload exhausts memory and blocks the thread"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["javascript", "node", "package", "seroval", "server-functions", "solid", "tanstack-start"]
not_affected_if: ["no-untrusted-input", "version-outside-range"]
published_at: "2026-10-26T21:18:17+00:00"
first_seen_at: "2026-10-26T21:20:32+00:00"
updated_at: "2026-10-26T21:21:10+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116584", "first_seen_at": "2026-10-26T21:20:32+00:00"}]
---

# Seroval: crafted JSON payload exhausts memory and blocks the thread

Seroval's fromJSON and fromCrossJSON decoders accept an array node whose element list is not a real array, so a small payload can set a large length that drives memory allocation and loop count. An unauthenticated request can exhaust the process or block its event loop, causing a denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version: `npm ls seroval` (or `pnpm why seroval`, `yarn why seroval`) and look for any version from `1.4.1` up to but not including `1.6.8`.
- Check whether your application deserializes untrusted input with `fromJSON` or `fromCrossJSON` from seroval, for example in server functions or RPC endpoints.

## Fix

- Upgrade seroval to `1.6.8` or later, including transitive copies pulled in by frameworks.
- Rebuild and redeploy the server so the bundled copy is replaced.

## Timeline

- 2026-10-26T21:20:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116584

## From the sources

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.4.1 until 1.6.8, fromJSON and fromCrossJSON do not require an array node's element list to be an actual array. A small crafted payload can supply an attacker-controlled length that determines memory allocation and decoder iterations independently of payload size, allowing an unauthenticated request to exhaust the process or block its thread. This issue is a residual bypass of the remediation for CVE-2026-23957. This issue is fixed in version 1.6.8.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_