GHSA-97r2-qh9m-474h Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS)

• npm seroval: < 1.6.8 → fixed in 1.6.8

Summary `fromJSON` and `fromCrossJSON` used two node fields without checking them. • An array node's element list was not checked to be an array. A small payload could set the length the decoder looped over. This part is also tracked in GHSA-wp97-x4hv-qvhp. • A sequence node's done index was not checked. A crafted value produced an iterator that never finished. Impact A service that passes untrusted input to `fromJSON` or `fromCrossJSON` can be made unavailable by an unauthenticated request. • The array case blocks the thread while the decoder runs. • The sequence case makes any code that reads the resulting iterator to the end run forever. Patches Fixed in `[email protected]`. • Element lists must be arrays. • A sequence node's throw and done indices must be integers from -1 up to the last element index. Invalid input throws `SerovalMalformedNodeError`. Workarounds None. Upgrade to 1.6.8.