CVE-2026-116584
Deferred Deferred - Pending Action

Seroval JavaScript Value Stringification Memory Exhaustion

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: GitHub, Inc.

Description
Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.4.1 until 1.6.8, fromJSON and fromCrossJSON do not require an array node's element list to be an actual array. A small crafted payload can supply an attacker-controlled length that determines memory allocation and decoder iterations independently of payload size, allowing an unauthenticated request to exhaust the process or block its thread. This issue is a residual bypass of the remediation for CVE-2026-23957. This issue is fixed in version 1.6.8.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-27
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-116584
EUVD
EUVD-2026-110463

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
lxsmnsyc seroval >= 1.4.1, < 1.6.8

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Seroval is a JavaScript library for value stringification that supports complex structures beyond JSON.stringify. Versions 1.4.1 to 1.6.7 have a flaw where fromJSON and fromCrossJSON functions do not validate that an array node's element list is actually an array. An attacker can craft a payload with a malicious length value to control memory allocation and decoder iterations independently of the payload size. This can lead to resource exhaustion or thread blocking in the process.

Impact Analysis

This vulnerability allows unauthenticated attackers to send specially crafted requests that consume excessive system resources. This could cause denial of service by crashing the application or making it unresponsive due to thread exhaustion. Systems using affected versions of Seroval may experience performance degradation or complete service disruption.

Mitigation Strategies

Update Seroval to version 1.6.8 or later to address the vulnerability. Review any applications using Seroval versions between 1.4.1 and 1.6.8 for potential exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116584. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart