Description
deserializeTypedArray casts the source node to ArrayBuffer without checking it and never bounds the element count. Pass a plain object with a length property and it hits the array-like TypedArray constructor, allocating that many elements. The offset guard above it can’t stop this: source.byteLength is undefined, so the comparison is always false.
Recommendation
Update the seroval package to the latest compatible version. Followings are version details:
- Affected version(s): <= 1.6.2
- Patched version(s): 1.6.3
References
Could your website be exposed too?
SmartScanner can check your website for Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization and gives you actionable findings to investigate.
Start a free scanRelated Issues
- seroval Affected by Remote Code Execution via JSON Deserialization - CVE-2026-23737
- seroval Affected by Prototype Pollution via JSON Deserialization - CVE-2026-23736
- Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length - CVE-2026-116584
- ExifReader: DoS via Crafted HEIC/AVIF iloc Box - Memory Exhaustion - CVE-2026-85715
You might also like:
See something that needs correcting? Let us knowUpdated October 05, 2026