CVE-2026-116584: Seroval denial of service via array-like object in deserialization

CVE-2026-116584 · Severity: high · CVSS 7.5 · Published 2026-10-26

Seroval is a JavaScript serialization library used to stringify and deserialize complex data structures. Versions 1.4.1 through 1.6.7 contain a flaw where attackers can craft malicious payloads that cause the deserializer to allocate memory and iterate based on an attacker-controlled length value, potentially exhausting server resources or blocking threads. This is a residual bypass of a prior security fix.

Technologies: Lxsmnsyc Seroval, seroval (npm). Vendors: Lxsmnsyc, npm.

Quick answers

Is CVE-2026-116584 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-116584 being exploited in the wild.
How severe is CVE-2026-116584?
High severity, with a CVSS score of 7.5, published 26 October 2026.
Which products and versions are affected?
Lxsmnsyc Seroval 1.4.1 through 1.6.7; seroval (npm) >= 1.4.1, <= 1.6.7, SEMVER:introduced=1.4.1,fixed=1.6.8.
Is there a fix for CVE-2026-116584?
Yes. seroval (npm): upgrade to 1.6.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116584 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-116584?
Check whether you run Lxsmnsyc Seroval or seroval (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • seroval (npm): upgrade to 1.6.8 or later
    npm install seroval@1.6.8

Technical details

The vulnerability exists in the fromJSON and fromCrossJSON deserialization functions, which fail to properly validate that array node element lists are genuine arrays. An attacker can supply an array-like object (such as {length: N}) where the length property is attacker-controlled, causing the deserializer to allocate memory and perform iterations independently of actual payload size. This affects deserialization of arrays, objects, records, Sets, Maps, and Sequences.

Affected products

  • lxsmnsyc Seroval 1.4.1 through 1.6.7

Identifiers

  • CVE-2026-116584
  • GHSA-wp97-x4hv-qvhp

Timeline

  • 2026-10-26: disclosed
  • 2026-09-28: patched: Patch committed to fix validation of node element lists

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.