CVE-2026-24006
High · 7.5CVSS
7.5
EPSS
0.4%
Published
Jan 22, 2026
CISA due date
—
The record
Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, serialization of objects with extreme depth can exceed the maximum call stack limit. In version 1.4.1, Seroval introduces a `depthLimit` parameter in serialization/deserialization methods. An error will be thrown if the depth limit is reached.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | seroval | 0 | 1.4.1 |
Related vulnerabilities
- GHSA-3j22-8qj3-26mx Seroval affected by Denial of Service via Deeply Nested Objects Same vulnerability
- CVE-2026-23956 seroval facilitates JS value stringification, including complex structures beyond… Also affects seroval
- CVE-2026-23957 seroval facilitates JS value stringification, including complex structures beyond… Also affects seroval
- CVE-2026-23736 seroval facilitates JS value stringification, including complex structures beyond… Also affects seroval
- CVE-2026-23737 seroval facilitates JS value stringification, including complex structures beyond… Also affects seroval
- GHSA-66fc-rw6m-c2q6 Seroval affected by Denial of Service via Array serialization Also affects seroval
- GHSA-hx9m-jf43-8ffr seroval affected by Denial of Service via RegExp serialization Also affects seroval
- GHSA-3rxj-6cgf-8cfw seroval Affected by Remote Code Execution via JSON Deserialization Also affects seroval