CVE-2026-116584: Denial of Service via Unvalidated Node Element Lists in Seroval

Vulnerability ID: CVE-2026-116584
CVSS Score: 7.5
Published: 2026-10-28

A Denial of Service (DoS) vulnerability exists in the Seroval JavaScript serialization library affecting versions 1.4.1 through 1.6.7. The deserialization routines fromJSON and fromCrossJSON fail to verify that node element lists are actual JavaScript Array primitives before reading their length property. An unauthenticated remote attacker can supply a compact, malformed JSON payload containing an array-like object with an arbitrary length value, causing unbounded memory allocation and synchronous loop iterations that block the event loop or crash the process via heap exhaustion.

TL;DR

Seroval versions >= 1.4.1 and < 1.6.8 are vulnerable to Denial of Service in fromJSON and fromCrossJSON because node element lists are not validated with Array.isArray(), allowing attackers to pass counterfeit objects like {"length": 2000000} to trigger excessive memory allocation and CPU exhaustion.

⚠️ Exploit Status: POC

Technical Details

• CVE ID: CVE-2026-116584 (GHSA-wp97-x4hv-qvhp)
• Weakness Class: CWE-770: Allocation of Resources Without Limits or Throttling
• Attack Vector: Network (Unauthenticated JSON Deserialization)
• CVSS v3.1 Score: 7.5 High (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
• EPSS Score: 0.36% (30.19th Percentile)
• Impact: Denial of Service (V8 Heap OOM & Event Loop Starvation)
• Exploit Status: PoC Available (Unit tests in official patch)
• CISA KEV Status: Not Listed

Affected Systems

• seroval
• seroval-plugins
• seroval: >= 1.4.1, < 1.6.8 (Fixed in: 1.6.8)

Code Analysis

Commit: cdcee3e

fix: validate node element lists during deserialization

diff --git a/packages/seroval/src/core/context/deserializer.ts b/packages/seroval/src/core/context/deserializer.ts
index 733650d8..f1905503 100644
--- a/packages/seroval/src/core/context/deserializer.ts
+++ b/packages/seroval/src/core/context/deserializer.ts
@@ -276,12 +276,27 @@ function deserializeReference(
   );
 }

+// A node's element list arrives from untrusted input. Without this check a
+// non-array such as `{"length":1e9}` (or `{"length":"Infinity"}`) is accepted:
+// its `length` drives allocation and iteration with no matching data on the
+// wire, so a tiny payload forces unbounded work. A genuine list can only be as
+// large as the elements actually present in the input.
+function validateNodeList(
+  node: SerovalNode | SerovalObjectRecordNode,
+  list: unknown,
+): void {
+  if (!Array.isArray(list)) {
+    throw new SerovalMalformedNodeError(node as SerovalNode);
+  }
+}
+
 function deserializeArray(
   ctx: DeserializerContext,
   depth: number,
   node: SerovalArrayNode,
 ): unknown[] {
   const items = node.a;
+  validateNodeList(node, items);
   const len = items.length;
   const result: unknown[] = assignIndexedValue(
     ctx,

Mitigation Strategies

• Upgrade seroval and associated packages to version 1.6.8 or higher to enforce strict Array.isArray() checks on AST node element lists.
• Use package manager lockfile overrides (npm/pnpm overrides or Yarn resolutions) to force transitive framework dependencies to resolve seroval to >= 1.6.8.
• Implement pre-deserialization JSON schema validation to reject AST payloads containing non-array objects in .a, .k, .v, .e.k, or .e.v properties.
• Isolate untrusted deserialization tasks within Worker Threads configured with strict V8 resource limits (maxOldGenerationSizeMb) and execution timeouts.

Remediation Steps:

1. Audit project lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock) to identify all direct and transitive installations of seroval between 1.4.1 and 1.6.7.
2. Run 'npm install seroval@^1.6.8' (or equivalent pnpm/yarn command) or configure package.json overrides to pin seroval to >= 1.6.8.
3. Verify the installed version using 'npm ls seroval' to confirm no vulnerable versions remain in the dependency tree.
4. Ensure RPC and deserialization error handlers catch SerovalMalformedNodeError and return HTTP 400 Bad Request responses.

References

• GitHub Security Advisory: GHSA-wp97-x4hv-qvhp
• Seroval Fix Commit: validate node element lists during deserialization
• Seroval Release v1.6.8
• NVD - CVE-2026-116584 Detail
• CVE.org Record: CVE-2026-116584
• CVEListV5 JSON Record for CVE-2026-116584

Read the full report for CVE-2026-116584 on our website for more details including interactive diagrams and full exploit analysis.