Vulnerability · Published Mar 31, 2026 · Assigned by GitHub_M
CVE-2026-34043Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects
Medium 5.9
In plain English
A medium-severity uncontrolled resource consumption in serialize-javascript from yahoo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Serialize JavaScript to a superset of JSON that includes regular expressions and functions. Prior to version 7.0.5, there is a Denial of Service (DoS) vulnerability caused by CPU exhaustion. When serializing a specially crafted "array-like" object (an object that inherits from Array.prototype but has a very large length property), the process enters an intensive loop that consumes 100% CPU and hangs indefinitely. This issue has been patched in version 7.0.5.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | aspnetcore-runtime-8.0 | 8.0.27-1.el10_2 | ALSA-2026:21286 |
| AlmaLinux:8 | aspnetcore-runtime-8.0 | 8.0.27-1.el8_10 | ALSA-2026:21291 |
| AlmaLinux:9 | aspnetcore-runtime-8.0 | 8.0.27-1.el9_8 | ALSA-2026:21293 |
| AlmaLinux:10 | aspnetcore-runtime-dbg-8.0 | 8.0.27-1.el10_2 | ALSA-2026:21286 |
| AlmaLinux:8 | aspnetcore-runtime-dbg-8.0 | 8.0.27-1.el8_10 | ALSA-2026:21291 |
| AlmaLinux:9 | aspnetcore-runtime-dbg-8.0 | 8.0.27-1.el9_8 | ALSA-2026:21293 |
| AlmaLinux:10 | aspnetcore-targeting-pack-8.0 | 8.0.27-1.el10_2 | ALSA-2026:21286 |
| AlmaLinux:8 | aspnetcore-targeting-pack-8.0 | 8.0.27-1.el8_10 | ALSA-2026:21291 |
| AlmaLinux:9 | aspnetcore-targeting-pack-8.0 | 8.0.27-1.el9_8 | ALSA-2026:21293 |
| AlmaLinux:10 | dotnet-apphost-pack-8.0 | 8.0.27-1.el10_2 | ALSA-2026:21286 |
| AlmaLinux:8 | dotnet-apphost-pack-8.0 | 8.0.27-1.el8_10 | ALSA-2026:21291 |
| AlmaLinux:9 | dotnet-apphost-pack-8.0 | 8.0.27-1.el9_8 | ALSA-2026:21293 |
| AlmaLinux:10 | dotnet-hostfxr-8.0 | 8.0.27-1.el10_2 | ALSA-2026:21286 |
| AlmaLinux:8 | dotnet-hostfxr-8.0 | 8.0.27-1.el8_10 | ALSA-2026:21291 |
| AlmaLinux:9 | dotnet-hostfxr-8.0 | 8.0.27-1.el9_8 | ALSA-2026:21293 |
| AlmaLinux:10 | dotnet-runtime-8.0 | 8.0.27-1.el10_2 | ALSA-2026:21286 |
| AlmaLinux:8 | dotnet-runtime-8.0 | 8.0.27-1.el8_10 | ALSA-2026:21291 |
| AlmaLinux:9 | dotnet-runtime-8.0 | 8.0.27-1.el9_8 | ALSA-2026:21293 |
| AlmaLinux:10 | dotnet-runtime-dbg-8.0 | 8.0.27-1.el10_2 | ALSA-2026:21286 |
| AlmaLinux:8 | dotnet-runtime-dbg-8.0 | 8.0.27-1.el8_10 | ALSA-2026:21291 |
| AlmaLinux:9 | dotnet-runtime-dbg-8.0 | 8.0.27-1.el9_8 | ALSA-2026:21293 |
| AlmaLinux:10 | dotnet-sdk-8.0 | 8.0.127-1.el10_2 | ALSA-2026:21286 |
| AlmaLinux:8 | dotnet-sdk-8.0 | 8.0.127-1.el8_10 | ALSA-2026:21291 |
| AlmaLinux:9 | dotnet-sdk-8.0 | 8.0.127-1.el9_8 | ALSA-2026:21293 |
| AlmaLinux:10 | dotnet-sdk-8.0-source-built-artifacts | 8.0.127-1.el10_2 | ALSA-2026:21286 |
| AlmaLinux:8 | dotnet-sdk-8.0-source-built-artifacts | 8.0.127-1.el8_10 | ALSA-2026:21291 |
| AlmaLinux:9 | dotnet-sdk-8.0-source-built-artifacts | 8.0.127-1.el9_8 | ALSA-2026:21293 |
| AlmaLinux:10 | dotnet-sdk-dbg-8.0 | 8.0.127-1.el10_2 | ALSA-2026:21286 |
| AlmaLinux:8 | dotnet-sdk-dbg-8.0 | 8.0.127-1.el8_10 | ALSA-2026:21291 |
| AlmaLinux:9 | dotnet-sdk-dbg-8.0 | 8.0.127-1.el9_8 | ALSA-2026:21293 |
| AlmaLinux:10 | dotnet-targeting-pack-8.0 | 8.0.27-1.el10_2 | ALSA-2026:21286 |
| AlmaLinux:8 | dotnet-targeting-pack-8.0 | 8.0.27-1.el8_10 | ALSA-2026:21291 |
| AlmaLinux:9 | dotnet-targeting-pack-8.0 | 8.0.27-1.el9_8 | ALSA-2026:21293 |
| AlmaLinux:10 | dotnet-templates-8.0 | 8.0.127-1.el10_2 | ALSA-2026:21286 |
| AlmaLinux:8 | dotnet-templates-8.0 | 8.0.127-1.el8_10 | ALSA-2026:21291 |
| AlmaLinux:9 | dotnet-templates-8.0 | 8.0.127-1.el9_8 | ALSA-2026:21293 |
| Debian:12 | node-serialize-javascript | no fix listed | DEBIAN-CVE-2026-34043 |
| Debian:13 | node-serialize-javascript | no fix listed | DEBIAN-CVE-2026-34043 |
| Debian:14 | node-serialize-javascript | 7.0.5+~5.0.4-1 | DEBIAN-CVE-2026-34043 |
| Rocky Linux:10 | dotnet8.0 | 0:8.0.127-1.el10_2 | RLSA-2026:21286 |
| Rocky Linux:8 | dotnet8.0 | 0:8.0.127-1.el8_10 | RLSA-2026:21291 |
| Rocky Linux:9 | dotnet8.0 | 0:8.0.127-1.el9_8 | RLSA-2026:21293 |
| Ubuntu:22.04:LTS | node-serialize-javascript | no fix listed | UBUNTU-CVE-2026-34043 |
| Ubuntu:24.04:LTS | node-serialize-javascript | no fix listed | UBUNTU-CVE-2026-34043 |
| Ubuntu:25.10 | node-serialize-javascript | no fix listed | UBUNTU-CVE-2026-34043 |
| Ubuntu:26.04:LTS | node-serialize-javascript | no fix listed | UBUNTU-CVE-2026-34043 |
| Ubuntu:26.10 | node-serialize-javascript | no fix listed | UBUNTU-CVE-2026-34043 |
| npm | serialize-javascript | 7.0.5 | GHSA-qj8w-gfj5-8c6v |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| yahoo | serialize-javascript | < 7.0.5 |
Weakness: CWE-400, CWE-834 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H