High severity · published Jan 22, 2026
CVE-2026-24006
Seroval affected by Denial of Service via Deeply Nested Objects
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0
and below, serialization of objects with extreme depth can exceed the maximum call stack limit. In version 1.4.1, Seroval introduces a `depthLimit` parameter in serialization/deserialization methods. An error will be thrown if the depth limit is reached.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SE
seroval · lxsmnsyc
< 1.4.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-24006
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-24006
Patch
https://github.com/lxsmnsyc/seroval/commit/ce9408ebc87312fcad345a73c172212f2a798060
Mitigation
https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-3j22-8qj3-26mx
More from seroval
9.8
CVE-2026-104846
Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of CVE-2026-59940)
9.8
CVE-2026-59940
Seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization
9.8
CVE-2026-23736
seroval Affected by Prototype Pollution via JSON Deserialization
7.5
CVE-2026-116584
Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length
7.5
CVE-2026-116581
Seroval: fromJSON deserializer trusts sequence doneAt (unauthenticated event-loop DoS)