Executive brief
Seroval is a JavaScript serialization library used to convert complex data structures into strings. An attacker can cause the application to crash by sending specially crafted data with extreme object nesting depth, which exhausts the call stack and makes the service unavailable. This is a network-based denial-of-service vulnerability that requires no authentication or user interaction.
Technical details
This is a stack exhaustion vulnerability (CWE-770) in Seroval's serialization/deserialization mechanism. When processing objects with extreme nesting depth, the recursive serialization logic exceeds the JavaScript call stack limit, causing a denial of service. The vulnerability affects all versions prior to 1.4.1. The attack is network-accessible and requires no privileges or user interaction—any external input passed to Seroval's serialization methods can trigger the crash. The fix introduces a configurable depthLimit parameter that throws an error when the nesting depth threshold is reached, preventing stack exhaustion. Patch is available in version 1.4.1 and later.
Affected products
- lxsmnsyc seroval <=1.4.0
Timeline
- 2026-01-22: disclosed: Advisory published
- 2026-01-21: patched: Fix released in version 1.4.1