GHSA-qj8w-gfj5-8c6v
Medium · 5.9CVSS
5.9
EPSS
—
Published
Mar 27, 2026
CISA due date
—
The record
Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | serialize-javascript | 5.0.0 | 7.0.5 |
| Chainguard | tileserver-gl | 0 | 5.5.0-r12 |
| Chainguard | tileserver-gl-fips | 0 | 5.5.0-r12 |
| Wolfi | tileserver-gl | 0 | 5.5.0-r12 |
Related vulnerabilities
- CVE-2026-34043 Serialize JavaScript to a superset of JSON that includes regular expressions and… Same vulnerability
- GHSA-5c6j-r48x-rmvq Serialize JavaScript is Vulnerable to RCE via RegExp.flags and… Also affects serialize-javascript
- CVE-2024-11831 A flaw was found in npm-serialize-javascript. Also affects serialize-javascript
- GHSA-27v5-c462-wpq7 path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards Also affects tileserver-gl
- GHSA-j3q9-mxjg-w52f path-to-regexp vulnerable to Denial of Service via sequential optional groups Also affects tileserver-gl
- CVE-2026-33916 Handlebars provides the power necessary to let users build semantic templates. Also affects tileserver-gl
- CVE-2026-33750 The brace-expansion library generates arbitrary strings containing a common prefix and… Also affects tileserver-gl
- GHSA-2qvq-rjwj-gvw9 Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection Also affects tileserver-gl