Description
What kind of vulnerability is it?
It is a Denial of Service (DoS) vulnerability caused by CPU exhaustion. When serializing a specially crafted “array-like” object (an object that inherits from Array.prototype but has a very large length property), the process enters an intensive loop that consumes 100% CPU and hangs indefinitely.
Recommendation
Update the serialize-javascript package to the latest compatible version. Followings are version details:
- Affected version(s): >= 5.0.0, < 7.0.5
- Patched version(s): 7.0.5
References
Could your website be exposed too?
SmartScanner can check your website for Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Cube Core is vulnerable to Denial of Service (DoS) via crafted request - CVE-2026-25957
- OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header - CVE-2026-59892
- Seroval affected by Denial of Service via Deeply Nested Objects - CVE-2026-24006
- Seroval affected by Denial of Service via Array serialization - CVE-2026-23957
You might also like:
See something that needs correcting? Let us knowUpdated May 21, 2026