CVE-2026-116581

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON and fromCrossJSON do not validate a sequence node's done index. A crafted done index can create an iterator that never finishes when application code consumes it to completion. An unauthenticated request to a service that deserializes untrusted input can therefore block the event loop, exhaust process memory, or make the service unavailable. This issue is fixed in version 1.6.8.

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON and fromCrossJSON do not validate a sequence node's done index. A crafted done index can create an iterator that never finishes when application code consumes it to completion. An unauthenticated request to a service that deserializes untrusted input can therefore block the event loop, exhaust process memory, or make the service unavailable. This issue is fixed in version 1.6.8.

Summary

fromJSON and fromCrossJSON used two node fields without checking them.

• An array node's element list was not checked to be an array. A small payload could set the length the decoder looped over. This part is also tracked in GHSA-wp97-x4hv-qvhp.
• A sequence node's done index was not checked. A crafted value produced an iterator that never finished.

Impact

A service that passes untrusted input to fromJSON or fromCrossJSON can be made unavailable by an unauthenticated request.

• The array case blocks the thread while the decoder runs.
• The sequence case makes any code that reads the resulting iterator to the end run forever.

Patches

Fixed in [email protected].

• Element lists must be arrays.
• A sequence node's throw and done indices must be integers from -1 up to the last element index.

Invalid input throws SerovalMalformedNodeError.

Workarounds

None. Upgrade to 1.6.8.

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON and fromCrossJSON do not validate a sequence node's done index. A crafted done index can create an iterator that never finishes when application code consumes it to completion. An unauthenticated request to a service that deserializes untrusted input can therefore block the event loop, exhaust process memory, or make the service unavailable. This issue is fixed in version 1.6.8.

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON and fromCrossJSON do not validate a sequence node's done index. A crafted done index can create an iterator that never finishes when application code consumes it to completion. An unauthenticated request to a service that deserializes untrusted input can therefore block the event loop, exhaust process memory, or make the service unavailable. This issue is fixed in version 1.6.8.

Summary

fromJSON and fromCrossJSON used two node fields without checking them.

• An array node's element list was not checked to be an array. A small payload could set the length the decoder looped over. This part is also tracked in GHSA-wp97-x4hv-qvhp.
• A sequence node's done index was not checked. A crafted value produced an iterator that never finished.

Impact

A service that passes untrusted input to fromJSON or fromCrossJSON can be made unavailable by an unauthenticated request.

• The array case blocks the thread while the decoder runs.
• The sequence case makes any code that reads the resulting iterator to the end run forever.

Patches

Fixed in [email protected].

• Element lists must be arrays.
• A sequence node's throw and done indices must be integers from -1 up to the last element index.

Invalid input throws SerovalMalformedNodeError.

Workarounds

None. Upgrade to 1.6.8.

TuxCare rebuilt seroval to address 2 CVEs. Fixed in 1.5.6-tuxcare.4.