{"schema":"threatline.record/2","record":{"id":"CVE-2026-116581","aliases":["GHSA-97r2-qh9m-474h"],"summary":"Seroval: fromJSON deserializer trusts sequence doneAt (unauthenticated event-loop DoS)","details":"Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON and fromCrossJSON do not validate a sequence node's done index. A crafted done index can create an iterator that never finishes when application code consumes it to completion. An unauthenticated request to a service that deserializes untrusted input can therefore block the event loop, exhaust process memory, or make the service unavailable. This issue is fixed in version 1.6.8.","categories":["Unclassified"],"product":"seroval","vendor":"lxsmnsyc","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116581","source_modified_at":"2026-10-26T20:41:52.905Z","fetched_at":"2026-10-26T23:45:56.352924Z","product":"seroval","vendor":"lxsmnsyc","versions":[{"version":"< 1.6.8","status":"affected"}],"defaultStatus":null},{"source":"GitHub Advisory Database","source_url":"https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-97r2-qh9m-474h","source_modified_at":"2026-10-26T20:37:35Z","fetched_at":"2026-10-26T23:45:56.352924Z","package":{"ecosystem":"npm","name":"seroval"},"range":"<= 1.6.7"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-97r2-qh9m-474h","source_modified_at":"2026-10-26T20:37:35Z","fetched_at":"2026-10-26T23:45:56.352924Z","package":{"ecosystem":"npm","name":"seroval"},"version":"1.6.8"}],"cvss":7.5,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-26T20:41:52.905Z","modified_at":"2026-10-26T20:41:52.905Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-116581","fetched_at":"2026-10-26T23:45:56.352924Z","source_modified_at":"2026-10-26T20:41:52.905Z"},{"source":"GitHub Advisory Database","url":"https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-97r2-qh9m-474h","fetched_at":"2026-10-26T23:45:56.352924Z","source_modified_at":"2026-10-26T20:37:35Z"}],"sources":["CVE List","GitHub Advisory Database"],"references":[{"source":"CVE List","url":"https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-97r2-qh9m-474h","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/lxsmnsyc/seroval/commit/e176f9267e59ddd6c9de89cc9fe85c5b37a5b728","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/lxsmnsyc/seroval/releases/tag/seroval@1.6.8","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-26T20:41:52.905Z","content_hash":"ffc4329c19bf9455622304d436898c3a998a98aaddbe21880691745af6d3996f"}}