Vulnerability · Published Oct 26, 2026 · Assigned by GitHub_M

CVE-2026-116581Seroval: fromJSON deserializer trusts sequence doneAt (unauthenticated event-loop DoS)

High 7.5

In plain English

A high-severity infinite loop in seroval from lxsmnsyc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 39% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.5%top 60.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON and fromCrossJSON do not validate a sequence node's done index. A crafted done index can create an iterator that never finishes when application code consumes it to completion. An unauthenticated request to a service that deserializes untrusted input can therefore block the event loop, exhaust process memory, or make the service unavailable. This issue is fixed in version 1.6.8.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	seroval	1.6.8	GHSA-97r2-qh9m-474h

Affected products (as reported)

Vendor	Product	Versions
lxsmnsyc	seroval	< 1.6.8

Weakness: CWE-835, CWE-1284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-97r2-qh9m-474h x_refsource_CONFIRM
https://github.com/lxsmnsyc/seroval/commit/e176f9267e59ddd6c9de89cc9fe85c5b37a5b728 x_refsource_MISC
https://github.com/lxsmnsyc/seroval/releases/tag/seroval@1.6.8 x_refsource_MISC