Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects

Description

What kind of vulnerability is it?

It is a Denial of Service (DoS) vulnerability caused by CPU exhaustion. When serializing a specially crafted “array-like” object (an object that inherits from Array.prototype but has a very large length property), the process enters an intensive loop that consumes 100% CPU and hangs indefinitely.

Recommendation

Update the serialize-javascript package to the latest compatible version. Followings are version details:

• Affected version(s): < 7.0.5
• Patched version(s): 7.0.5

References

• GHSA-qj8w-gfj5-8c6v
• CVE-2026-34043
• CWE-400
• CWE-834
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Seroval affected by Denial of Service via Array serialization - CVE-2026-23957
• Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution - CVE-2026-30939
• Seroval affected by Denial of Service via Deeply Nested Objects - CVE-2026-24006
• Cube Core is vulnerable to Denial of Service (DoS) via crafted request - CVE-2026-25957

Tags:

npm

serialize-javascript