Description
fromJSON and fromCrossJSON did not check that an array node’s element list is an array. A small crafted payload could set the length the decoder used. That length controlled how much memory was allocated and how many times the decoder looped, and it did not depend on the size of the payload.
Recommendation
Update the seroval package to the latest compatible version. Followings are version details:
- Affected version(s): >= 1.4.1, <= 1.6.7
- Patched version(s): 1.6.8
References
Could your website be exposed too?
SmartScanner can check your website for Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Seroval affected by Denial of Service via Array serialization - CVE-2026-23957
- Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS) - CVE-2026-116581
- Seroval affected by Denial of Service via Deeply Nested Objects - CVE-2026-24006
- jsPDF Vulnerable to Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder - CVE-2026-24133
You might also like:
See something that needs correcting? Let us knowUpdated October 28, 2026