CVE-2026-116581

The record

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON and fromCrossJSON do not validate a sequence node's done index. A crafted done index can create an iterator that never finishes when application code consumes it to completion. An unauthenticated request to a service that deserializes untrusted input can therefore block the event loop, exhaust process memory, or make the service unavailable. This issue is fixed in version 1.6.8.

Affected packages

Related vulnerabilities

• CVE-2026-63475 isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. CWE-835
• CVE-2026-121261 A vulnerability has been found in phpMyAdmin ShapeFile up to 4.0.1. CWE-835
• CVE-2026-121400 FreeRDP before 3.32.2 contains a denial-of-service vulnerability in… CWE-835
• CVE-2026-119738 The VobSub subtitle decoder libsub_vob (part of the Amlogic DroidLogic SubTitleService)… CWE-835
• CVE-2026-120596 A remotely exploitable denial-of-service vulnerability exists in the TCP options parser… CWE-835
• CVE-2026-120458 Kvazaar through 2.3.2 contains an infinite loop vulnerability in read_header() in… CWE-835
• CVE-2026-120251 imagecodecs 2026.3.6 through 2026.10.10 contains an infinite loop vulnerability in… CWE-835
• CVE-2026-120194 A flaw was found in json-glib. CWE-835