CVE-2026-116581

CVSS 7.5 HIGH

Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS)

Mô tả

fromJSON and fromCrossJSON used two node fields without checking them.

An array node's element list was not checked to be an array. A small payload could set the length the decoder looped over. This part is also tracked in GHSA-wp97-x4hv-qvhp.
A sequence node's done index was not checked. A crafted value produced an iterator that never finished.

A service that passes untrusted input to fromJSON or fromCrossJSON can be made unavailable by an unauthenticated request.

The array case blocks the thread while the decoder runs.
The sequence case makes any code that reads the resulting iterator to the end run forever.

Fixed in seroval@1.6.8.

Element lists must be arrays.
A sequence node's throw and done indices must be integers from -1 up to the last element index.

Invalid input throws SerovalMalformedNodeError.

None. Upgrade to 1.6.8.

Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Package	Bản bị ảnh hưởng	Bản đã sửa
npm `seroval`	`<= 1.6.7`	`1.6.8`
npm `seroval`	`< 1.6.8`	`1.6.8`

Không nhận ra loại tác động nào từ CWE, vector hay mô tả.

CVE.org · Đơn vị cấp mã: GitHub_M
CVE.org · SSVC: Tự động hoá được: yes · Khai thác: none · Tác động kỹ thuật: partial
OSV.dev · ID: GHSA-97r2-qh9m-474h