Memory Exhaustion Vulnerability in Seroval JavaScript Library

CVE-2026-116584

What is CVE-2026-116584?

The Seroval library, which aids in JavaScript value stringification, is affected by a vulnerability that allows attackers to exploit fromJSON and fromCrossJSON functions. These functions improperly handle input, enabling attackers to supply a crafted payload that specifies a length for memory allocation and decoder iterations without being constrained by the actual size of the payload. This flaw can lead to memory exhaustion, causing process disruption or thread blocking. This issue represents a residual bypass of previous remediation efforts and is addressed in version 1.6.8.

References