Description
What kind of vulnerability is it?
It is a Denial of Service (DoS) vulnerability caused by CPU exhaustion. When serializing a specially crafted “array-like” object (an object that inherits from Array.prototype but has a very large length property), the process enters an intensive loop that consumes 100% CPU and hangs indefinitely.
Recommendation
Update the serialize-javascript package to the latest compatible version. Followings are version details:
- Affected version(s): >= 5.0.0, < 7.0.5
- Patched version(s): 7.0.5
References
Could your website be exposed too?
SmartScanner can check your website for Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects and gives you actionable findings to investigate.
Start a free scanRelated Issues
- liquidjs has a Denial of Service via circular block reference in layout - CVE-2026-41311
- Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation - CVE-2026-33939
- Cube Core is vulnerable to Denial of Service (DoS) via crafted request - CVE-2026-25957
- Seroval affected by Denial of Service via Array serialization - CVE-2026-23957
You might also like:
See something that needs correcting? Let us knowUpdated May 21, 2026