Description
fromJSON and fromCrossJSON used two node fields without checking them.
- An array node’s element list was not checked to be an array. A small payload could set the length the decoder looped over. This part is also tracked in GHSA-wp97-x4hv-qvhp.
- A sequence node’s done index was not checked.
Recommendation
Update the seroval package to the latest compatible version. Followings are version details:
- Affected version(s): <= 1.6.7
- Patched version(s): 1.6.8
References
Could your website be exposed too?
SmartScanner can check your website for Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS) and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length - CVE-2026-116584
- Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS) - CVE-2026-101903
- node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS - CVE-2026-54156
- Svelte devalue: DoS via sparse array deserialization - CVE-2026-42570
You might also like:
See something that needs correcting? Let us knowUpdated October 28, 2026