Seroval
CVE-2026-24006
HIGH
GHSA-3j22-8qj3-26mx
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, serialization of objects with extreme depth can exceed the maximum call stack limit. In version 1.4.1, Seroval introduces a depthLimit parameter in serialization/deserialization methods. An error will be thrown if the depth limit is reached.
AnalysisAI
Seroval versions 1.4.0 and below are vulnerable to denial of service attacks due to unbounded recursion when serializing deeply nested objects, allowing remote attackers to crash applications by exceeding the call stack limit. The vulnerability affects the deserialization library's handling of complex data structures without depth validation. Version 1.4.1 introduces a configurable depthLimit parameter to prevent exploitation of this resource exhaustion condition.
Technical ContextAI
Classified as CWE-770 (Allocation of Resources Without Limits or Throttling). Affects Seroval. Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, serialization of objects with extreme depth can exceed the maximum call stack limit. In version 1.4.1, Seroval introduces a depthLimit parameter in serialization/deserialization methods. An error will be thrown if the depth limit is reached.
RemediationAI
A vendor patch is available — apply it immediately. Restrict network access to the affected service where possible.
Deserialization of attacker-controlled JSON in plugin-capable Seroval releases 0.12.0 through 1.6.1 lets a remote unauth
Denial of service in Seroval versions prior to 1.6.3 allows unauthenticated remote attackers to exhaust CPU and memory b
Arbitrary code execution in Seroval versions 1.4.0 and below allows authenticated attackers to execute malicious JavaScr
Seroval versions 1.4.0 and below are vulnerable to denial of service through malformed deserialization payloads that spe
Seroval versions 1.4.0 and below allow remote attackers to cause denial of service through maliciously crafted RegExp pa
Seroval is affected by improperly controlled modification of object prototype attributes (prototype pollution) (CVSS 7.3
Same technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: HighShare
External POC / Exploit Code
Leaving vuln.today