Executive brief
A vulnerability in the serialize-javascript library can allow an attacker to crash or freeze an application by causing it to consume 100% of its CPU. This library is commonly used to convert JavaScript objects into a format that can be sent over a network or stored. If an attacker can provide a specially crafted object to be processed, they can cause a denial-of-service condition, making the application unavailable to legitimate users.
Technical details
A Denial of Service (DoS) vulnerability exists in serialize-javascript due to uncontrolled resource consumption (CWE-400) and excessive iteration (CWE-834). The issue occurs when the library attempts to serialize an 'array-like' object that inherits from Array.prototype but possesses an extremely large 'length' property. This causes the serialization process to enter an intensive loop, consuming 100% CPU and hanging the process indefinitely. While the attack complexity is high, it can be triggered if the application processes untrusted data or is susceptible to prototype pollution. The vulnerability is fixed in version 7.0.5 by replacing 'instanceof Array' checks with 'Array.isArray()' and utilizing 'Object.keys()' for sparse array detection.
Affected products
- yahoo serialize-javascript >= 5.0.0, < 7.0.5
Timeline
- 2026-03-25: patched: Initial patch release v7.0.5
- 2026-03-27: advisory: GitHub Advisory published