seroval CVE-2026-116584

Exploitable only when the application passes untrusted, attacker-controlled input to seroval's fromJSON or fromCrossJSON (e.g. decoding request bodies) before any application-level validation runs, on affected versions 1.4.1 through 1.6.7. The concrete trigger is an array/Set/Map/sequence/stream node whose element list (the a, keys, or entry key/value lists) is replaced by a non-array array-like object such as {"length": 2000000} or {"length": "Infinity"}, causing allocation and loop count to follow the forged length rather than actual payload data. No authentication or user interaction is required (PR:N/UI:N). The limiting factor is deployment: services that never feed these functions untrusted input, or that have already upgraded to 1.6.8 (which rejects non-array lists with SerovalMalformedNodeError), are not exposed; the advisory states there is no workaround other than upgrading.

Signals are mostly consistent and point to a genuine but bounded availability problem rather than a critical emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) and CWE-770 describe a remote, unauthenticated, low-complexity resource-exhaustion flaw with availability-only impact - no confidentiality or integrity loss. EPSS is low at 0.36% (30th percentile), and the CVE is NOT on CISA KEV, so there is no evidence of active or widespread exploitation; this reads as a latent DoS, not a mass-exploited one. Counterbalancing the low EPSS, the GHSA advisory and the fix commit (including a regression test that tampers an array node's a to {length: 2_000_000} / {length: 'Infinity'}) make the trigger well understood and trivial to reproduce, so weaponization is easy for anyone who reads the public patch. The vuln.today Decision label is 'this_week', consistent with a real but non-emergency priority. No SSVC decision string (exploitation/automatable/technical-impact) is supplied in the input, so that framework cannot be cited directly. Net: prioritize patching this week for any service that deserializes untrusted input with seroval; it is a real, easily triggered DoS, but not a high-urgency actively-exploited case.

An application uses seroval's fromJSON or fromCrossJSON to decode an attacker-supplied request body before running its own validation. The attacker sends a small crafted payload in which an array node's element list is a non-array object such as {"length": 1e9}, so the attacker-controlled length drives memory allocation and decoder iterations independently of payload size. A public PoC reference exists in the form of the fix commit's regression test demonstrating the tampered-length payload; it is not packaged as a standalone working exploit. Given AV:N/AC:L/PR:N, a single unauthenticated request can exhaust process memory or block the event-loop thread indefinitely.