Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities.
CVE-2026-116581
Summary fromJSON and fromCrossJSON used two node fields without checking them. An array node's element list was not checked to be an array. A small payload could set the length the decoder looped over. This part is also tracked in GHSA-wp97-x4hv-qvhp. A sequence node's done index was not checked. A crafted value produced an iterator that never finished. Impact A service that passes untrusted input to fromJSON or fromCrossJSON can be made unavailable by an unauthenticated request. The array case blocks the thread while the decoder runs. The sequence case makes any code that reads the resulting iterator to the end run forever. Patches Fixed in seroval@1.6.8. Element lists must be arrays. A sequence node's throw and done indices must be integers from -1 up to the last element index. Invalid input throws SerovalMalformedNodeError. Workarounds None. Upgrade to 1.6.8.
Assessment
- CVSS
- 7.5 (v3.1)
- Severity
- High
- EPSS
- 0.00451% chance of exploitation in the next 30 days
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 26 October 2026
- Last updated
- 31 October 2026
- Affected
- npm · seroval
- Weakness
- CWE-1284, CWE-835
- Assigner
- security-advisories@github.com
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
At the source
References
- https://github.com/lxsmnsyc/seroval/commit/e176f9267e59ddd6c9de89cc9fe85c5b37a5b728
- https://github.com/lxsmnsyc/seroval/releases/tag/seroval@1.6.8
- https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-97r2-qh9m-474h
- https://nvd.nist.gov/vuln/detail/CVE-2026-116581
- https://github.com/lxsmnsyc/seroval/commit/cdcee3e3bc384ee844360844f8ea98fd2b275d69
- https://github.com/advisories/GHSA-97r2-qh9m-474h
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-116581