CVE-2026-116581
CVE-2026-116581 · Seroval: fromJSON deserializer trusts sequence doneAt (unauthenticated event-loop DoS)
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON and fromCrossJSON do not validate a sequence node's done index. A crafted done index can create an iterator that never finishes when application code consumes it to completion. An unauthenticated request to a service that deserializes untrusted input can therefore block the event loop, exhaust process memory, or make the service unavailable. This issue is fixed in version 1.6.8.
CVSS 7.5 · Élevée · EPSS 0,5% · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: node