GHSA-66fc-rw6m-c2q6HighCVSS 7.5

Seroval affected by Denial of Service via Array serialization

Published
January 21, 2026
Last Modified
January 22, 2026

🔗 CVE IDs covered (1)

📋 Description

Overriding encoded array lengths by replacing them with an excessively large value causes the deserialization process to significantly increase processing time.

Mitigation:
Seroval no longer encodes array lengths. Instead, it computes length using Array.prototype.length during deserialization.

🎯 Affected products1

  • npm/seroval:<= 1.4.0

🔗 References (4)