JavaScript Serialization Vulnerability in Seroval by lxsmnsyc
CVE-2026-24006

7.5HIGH

Key Information:

Vendor

Lxsmnsyc

Status
Seroval
Vendor
CVE Published:
22 January 2026

What is CVE-2026-24006?

Seroval, a tool for JavaScript value stringification, has a vulnerability in its handling of deep object serialization in versions 1.4.0 and earlier. This flaw allows serialization of complex objects beyond the limitations of standard JavaScript stringification methods, potentially leading to a failure due to exceeding the maximum call stack size during processing. To address this issue, version 1.4.1 of Seroval introduces a new depthLimit parameter within its serialization and deserialization functions, ensuring that an error is triggered if the defined depth limit is surpassed. This enhancement is crucial for developers to prevent runtime errors and maintain application stability.

Affected Version(s)

seroval < 1.4.1

References

https://github.com/lxsmnsyc/seroval/security/advisories/G...
x_refsource_CONFIRM
https://github.com/lxsmnsyc/seroval/commit/ce9408ebc87312...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.