EUVD-2026-91744
GHSA-jp82-f5mq-hwhp
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated attacker supplies untrusted serialized input (AV:N/AC:L/PR:N/UI:N); availability-only resource exhaustion (A:H) with no confidentiality or integrity impact and no scope change.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.3, deserializeTypedArray in fromJSON and fromCrossJSON trusts a deserialized source value as an ArrayBuffer and does not bound the serialized element count. An attacker can provide a small untrusted JSON object with a large length value, causing the array-like TypedArray constructor to synchronously allocate the selected number of elements and exhaust CPU or memory while starving the event loop. The offset check does not reject the crafted source because source.byteLength is undefined. DataView reaches a similar unchecked cast but throws rather than allocating, and the issue has no identified confidentiality or integrity impact. This issue is fixed in version 1.6.3.
AnalysisAI
Denial of service in Seroval versions prior to 1.6.3 allows unauthenticated remote attackers to exhaust CPU and memory by submitting a small crafted JSON payload whose TypedArray node declares an oversized element count, which the deserializer then allocates synchronously and unbounded while starving the event loop. Exploitation requires the target application to route attacker-controlled data into seroval's fromJSON or fromCrossJSON; the library is a JavaScript value-serialization dependency, so the practical exposure is limited to services that deserialize untrusted input with it. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target application deserialize attacker-controlled data using seroval's fromJSON or fromCrossJSON, and that the malicious payload contain a TypedArray node ('t' node with field 'l') declaring an oversized element length. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is an uncontrolled resource allocation / Denial-of-Service flaw (CWE-770) with no confidentiality or integrity impact, as reflected in the CVSS 3.1 vector (C:N/I:N/A:H) scoring 7.5. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to seroval 1.6.3 (vendor-released patch), which introduces the MAX_TYPED_ARRAY_LENGTH/MAX_BASE64_LENGTH bound of 1,000,000 elements both when serializing typed arrays, BigInt typed arrays and DataView values and when deserializing TypedArray and DataView nodes, rejecting oversized payloads with SerovalUnsupportedTypeError; the fix is captured in commits ac0163e420ac7dcbbefac4d069bcefad300a4851 and e54a6f62784b9e48e3a5fa2ab4089ca69fb8996e, with details in advisory GHSA-jp82-f5mq-hwhp. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every application and service that depends on Seroval, flag any endpoint that routes externally supplied JSON into fromJSON or fromCrossJSON, and apply immediate edge protections on those routes: strict request-body size limits, per-client rate limiting, and WAF or gateway rules that reject payloads containing TypedArray nodes with implausibly large declared element counts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Deserialization of attacker-controlled JSON in plugin-capable Seroval releases 0.12.0 through 1.6.1 lets a remote unauth
Arbitrary code execution in Seroval versions 1.4.0 and below allows authenticated attackers to execute malicious JavaScr
Seroval versions 1.4.0 and below are vulnerable to denial of service through malformed deserialization payloads that spe
Seroval versions 1.4.0 and below are vulnerable to denial of service attacks due to unbounded recursion when serializing
Seroval versions 1.4.0 and below allow remote attackers to cause denial of service through maliciously crafted RegExp pa
Seroval is affected by improperly controlled modification of object prototype attributes (prototype pollution) (CVSS 7.3
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today