# CVE-2026-116584: Seroval denial of service via array-like object in deserialization

Source: https://junglewise.ai/threats/cve-2026-116584-seroval-facilitates-javascript-value-stringification-including  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-26. Updated: 2026-10-26  
License: CC BY 4.0 with a link back

CVE-2026-116584 · Severity: high · CVSS 7.5 · Published 2026-10-26

Seroval is a JavaScript serialization library used to stringify and deserialize complex data structures. Versions 1.4.1 through 1.6.7 contain a flaw where attackers can craft malicious payloads that cause the deserializer to allocate memory and iterate based on an attacker-controlled length value, potentially exhausting server resources or blocking threads. This is a residual bypass of a prior security fix.

Technologies: [Lxsmnsyc Seroval](https://junglewise.ai/threats/technologies/lxsmnsyc-seroval), [seroval (npm)](https://junglewise.ai/threats/technologies/seroval). Vendors: [Lxsmnsyc](https://junglewise.ai/threats/vendors/lxsmnsyc), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-116584 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116584 being exploited in the wild.

**How severe is CVE-2026-116584?** High severity, with a CVSS score of 7.5, published 26 October 2026.

**Which products and versions are affected?** Lxsmnsyc Seroval 1.4.1 through 1.6.7; seroval (npm) >= 1.4.1, <= 1.6.7, SEMVER:introduced=1.4.1,fixed=1.6.8.

**Is there a fix for CVE-2026-116584?** Yes. seroval (npm): upgrade to 1.6.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116584 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-116584?** Check whether you run Lxsmnsyc Seroval or seroval (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- seroval (npm): upgrade to 1.6.8 or later

  ```sh
  npm install seroval@1.6.8
  ```


## Technical details

The vulnerability exists in the fromJSON and fromCrossJSON deserialization functions, which fail to properly validate that array node element lists are genuine arrays. An attacker can supply an array-like object (such as {length: N}) where the length property is attacker-controlled, causing the deserializer to allocate memory and perform iterations independently of actual payload size. This affects deserialization of arrays, objects, records, Sets, Maps, and Sequences.

## Affected products

- lxsmnsyc Seroval 1.4.1 through 1.6.7

## Identifiers

- CVE-2026-116584
- GHSA-wp97-x4hv-qvhp

## Timeline

- 2026-10-26: disclosed
- 2026-09-28: patched: Patch committed to fix validation of node element lists

## References

- [https://github.com/lxsmnsyc/seroval/commit/cdcee3e3bc384ee844360844f8ea98fd2b275d69](https://github.com/lxsmnsyc/seroval/commit/cdcee3e3bc384ee844360844f8ea98fd2b275d69)
- [https://github.com/lxsmnsyc/seroval/releases/tag/seroval@1.6.8](https://github.com/lxsmnsyc/seroval/releases/tag/seroval@1.6.8)

## Related threats

- [Seroval typed array constructor name injection](https://junglewise.ai/threats/cve-2026-116583-seroval-facilitates-javascript-value-stringification-including)
- [Seroval JavaScript RegExp code injection in HTML script elements](https://junglewise.ai/threats/cve-2026-116582-seroval-facilitates-javascript-value-stringification-including)
- [Seroval improper sequence node validation in deserialization](https://junglewise.ai/threats/cve-2026-116581-seroval-facilitates-javascript-value-stringification-including)
- [Seroval incomplete fix for AsyncIterator deserialization bypass](https://junglewise.ai/threats/cve-2026-116580-seroval-facilitates-javascript-value-stringification-including)
- [Seroval Promise thenable code execution via fromJSON deserialization](https://junglewise.ai/threats/cve-2026-104846-seroval-facilitates-js-value-stringification-including-complex)