GitHub Advisoryadvisory · npm

GHSA-66fc-rw6m-c2q6 Seroval affected by Denial of Service via Array serialization

HIGH Published 2026-01-21 Modified 2026-01-22 Official page ↗
Aliases
CVE-2026-23957
Ecosystem
npm
Packages
seroval
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-770
Reviewed
2026-01-21

Affected packages

• npm seroval: < 1.4.1 → fixed in 1.4.1

Description

Overriding encoded array lengths by replacing them with an excessively large value causes the deserialization process to significantly increase processing time. Mitigation: `Seroval` no longer encodes array lengths. Instead, it computes length using `Array.prototype.length` during deserialization.

Related

Alias · CVE (1)

  • CVE-2026-23957 seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. vulnerability

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References