CVE-2026-116581: Unauthenticated Event-Loop Denial of Service via Unvalidated Sequence Indices in Seroval

Vulnerability ID: CVE-2026-116581
CVSS Score: 7.5
Published: 2026-10-28

Seroval, a JavaScript serialization library used for transferring complex structures across network boundaries, contains an input validation vulnerability in versions prior to 1.6.8. The fromJSON and fromCrossJSON deserializers fail to validate array element lists and the termination boundaries (done and throw indices) of sequence nodes. By supplying out-of-bounds indices or forged array-like structures, an unauthenticated remote attacker can construct an iterator with an unreachable exit condition or trigger excessive loop iterations, halting the single-threaded JavaScript event loop and causing a denial of service.

TL;DR

Versions of the seroval npm package prior to 1.6.8 do not validate array node lists or sequence boundary indices (node.s and node.l) during JSON deserialization. Consuming a deserialized sequence with a crafted index triggers an infinite loop or memory exhaustion, freezing the Node.js, Deno, or Bun event loop. Upgrade to [email protected] to resolve this issue.

⚠️ Exploit Status: POC

Technical Details

• Vulnerability ID: CVE-2026-116581 / GHSA-97r2-qh9m-474h
• Affected Package: seroval (npm) < 1.6.8
• Weakness Class: CWE-835 (Infinite Loop) / CWE-1284 (Improper Quantity Validation)
• Attack Vector: Network (Unauthenticated JSON payload to fromJSON / fromCrossJSON)
• CVSS v3.1 Score: 7.5 HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
• EPSS Score: 0.45% (39.07th percentile)
• Primary Impact: Single-threaded JavaScript event-loop freeze / Denial of Service
• Patched Version: [email protected]

Affected Systems

• seroval npm package (< 1.6.8)
• Node.js, Deno, and Bun applications deserializing untrusted input via seroval fromJSON or fromCrossJSON
• seroval: < 1.6.8 (Fixed in: 1.6.8)

Code Analysis

Commit: e176f92

fix: validate sequence indices during deserialization

diff --git a/packages/seroval/src/core/context/deserializer.ts b/packages/seroval/src/core/context/deserializer.ts
index f1905503..8be0e719 100644
--- a/packages/seroval/src/core/context/deserializer.ts
+++ b/packages/seroval/src/core/context/deserializer.ts
@@ -844,11 +844,24 @@ function deserializeAsyncIteratorFactory(
   return NIL;
 }

+function isSequenceIndex(value: unknown, size: number): boolean {
+  return (
+    Number.isInteger(value) && (value as number) >= -1 && (value as number) < size
+  );
+}
+
 function deserializeSequence(
   ctx: DeserializerContext,
   depth: number,
   node: SerovalSequenceNode,
 ): Sequence {
+  validateNodeList(node, node.a);
+  // The iterator stops only when its index passes the done index, so both
+  // indices must be integers within the list.
+  const size = node.a.length;
+  if (!(isSequenceIndex(node.s, size) && isSequenceIndex(node.l, size))) {
+    throw new SerovalMalformedNodeError(node);
+  }
   const result = assignIndexedValue(
     ctx,
     node.i,
@@ -856,8 +869,7 @@ function deserializeSequence(
   );
   // Mark the id so an IteratorFactoryInstance can validate its source node type.
   assignNodeType(ctx, node.i, SerovalNodeType.Sequence);
-  validateNodeList(node, node.a);
-  for (let i = 0, len = node.a.length; i < len; i++) {
+  for (let i = 0; i < size; i++) {
     result.v[i] = deserialize(ctx, depth, node.a[i]);
   }
   return result;

Commit: cdcee3e

fix: validate node element lists during deserialization

Exploit Details

• GitHub: Official patch commit containing regression test cases (packages/seroval/test/sequence-metadata.test.ts) demonstrating sequence done and throw index tampering.
• GitHub: GitHub Security Advisory describing the unvalidated array node list and sequence doneAt vulnerability.

Mitigation Strategies

• Upgrade the seroval dependency to version 1.6.8 or higher across all projects and transitive dependencies.
• Avoid deserializing untrusted client input with fromJSON or fromCrossJSON unless strictly required by the application architecture.
• Implement pre-deserialization JSON schema validation to verify that node element lists (a) are arrays and sequence indices (s, l) are valid bounded integers.
• Enforce bounded iteration limits when consuming iterables derived from external or untrusted sources.

Remediation Steps:

1. Audit project dependencies using npm ls seroval, pnpm why seroval, or yarn why seroval to identify any versions prior to 1.6.8.
2. Update package.json to require seroval@^1.6.8 (or apply package manager overrides / resolutions if seroval is a transitive dependency).
3. Run npm install (or equivalent package manager command) and verify that the lockfile resolves seroval to version 1.6.8 or newer.
4. Ensure calls to fromJSON and fromCrossJSON properly catch SerovalMalformedNodeError and return appropriate HTTP 400 error responses.

References

• GitHub Security Advisory: GHSA-97r2-qh9m-474h
• Patch Commit: fix: validate sequence indices during deserialization
• Patch Commit: fix: validate node element lists during deserialization
• Seroval Release Tag: [email protected]
• CVE.org Record: CVE-2026-116581
• National Vulnerability Database (NVD): CVE-2026-116581

Read the full report for CVE-2026-116581 on our website for more details including interactive diagrams and full exploit analysis.