High severity · published Oct 26, 2026
CVE-2026-116584
Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length
New
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.4.1 until 1.6.8, fromJSON and fromCrossJSON do not require an array node's element list to be an actual array. A small crafted payload can supply an attacker-controlled length that determines memory allocation and decoder iterations independently of payload size, allowing an unauthenticated request to exhaust the process or block its thread. This issue is a residual bypass of the remediation for CVE-2026-23957. This issue is fixed in version 1.6.8.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SE
seroval · lxsmnsyc
>= 1.4.1, < 1.6.8 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-116584
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-116584
github.com
https://github.com/lxsmnsyc/seroval/commit/cdcee3e3bc384ee844360844f8ea98fd2b275d69
github.com
https://github.com/lxsmnsyc/seroval/releases/tag/seroval@1.6.8
github.com
https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-wp97-x4hv-qvhp
More from seroval
9.8
CVE-2026-104846
Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of CVE-2026-59940)
9.8
CVE-2026-59940
Seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization
9.8
CVE-2026-23736
seroval Affected by Prototype Pollution via JSON Deserialization
7.5
CVE-2026-116581
Seroval: fromJSON deserializer trusts sequence doneAt (unauthenticated event-loop DoS)
7.5
CVE-2026-104845
Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization