All vulnerabilities
CVE-2026-116581GHSA-97r2-qh9m-474h

Seroval: fromJSON deserializer trusts sequence doneAt (unauthenticated event-loop DoS)

lxsmnsyc seroval
Open in ThreatlineRecord JSON
CVSS
7.5High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in1.6.8Fixed versionGitHub
Published26 Oct 2026Updated 26 Oct 2026CVE List

What fixes it

  • 1.6.8seroval, npmGitHubnpm install seroval@1.6.8

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON and fromCrossJSON do not validate a sequence node's done index. A crafted done index can create an iterator that never finishes when application code consumes it to completion. An unauthenticated request to a service that deserializes untrusted input can therefore block the event loop, exhaust process memory, or make the service unavailable. This issue is fixed in version 1.6.8.

Text from CVE List

Affected versions 2

  • serovalaffected: < 1.6.8CVE List
  • seroval, npm<= 1.6.7GitHub

References 3