GHSA-3j22-8qj3-26mxHighCVSS 7.5

Seroval affected by Denial of Service via Deeply Nested Objects

Published
January 22, 2026
Last Modified
January 22, 2026

🔗 CVE IDs covered (1)

📋 Description

Serialization of objects with extreme depth can exceed the maximum call stack limit.

Mitigation:
Seroval introduces a depthLimit parameter in serialization/deserialization methods. An error will be thrown if the depth limit is reached.

🎯 Affected products1

  • npm/seroval:<= 1.4.0

🔗 References (4)