p PatchFirst

CVE-2026-24006

CVE-2026-24006 · Seroval affected by Denial of Service via Deeply Nested Objects

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, serialization of objects with extreme depth can exceed the maximum call stack limit. In version 1.4.1, Seroval introduces a `depthLimit` parameter in serialization/deserialization methods. An error will be thrown if the depth limit is reached.

CVSS 7.5 · High · EPSS 0.4% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • seroval

    Versions
    • < 1.4.1: Affected

    No fix published

  • seroval npm

    Affected ranges
    • SEMVER: < 1.4.1

    Update to 1.4.1

Original sources

Check your server →