GitHub Advisoryadvisory · npm

GHSA-3j22-8qj3-26mx Seroval affected by Denial of Service via Deeply Nested Objects

HIGH Published 2026-01-22 Modified 2026-01-22 Official page ↗
Aliases
CVE-2026-24006
Ecosystem
npm
Packages
seroval
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-770
Reviewed
2026-01-22

Affected packages

• npm seroval: < 1.4.1 → fixed in 1.4.1

Description

Serialization of objects with extreme depth can exceed the maximum call stack limit. Mitigation: `Seroval` introduces a `depthLimit` parameter in serialization/deserialization methods. An error will be thrown if the depth limit is reached.

Related

Alias · CVE (1)

  • CVE-2026-24006 Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. vulnerability

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References