# CVE-2026-34043: Yahoo serialize-javascript CPU exhaustion DoS via crafted array-like objects

Source: https://junglewise.ai/threats/cve-2026-34043-yahoo-serialize-javascript-cpu-exhaustion-dos-via-crafted-array  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-27. Updated: 2026-05-21  
License: CC BY 4.0 with a link back

CVE-2026-34043 · Severity: medium · CVSS 5.9 · Published 2026-03-27

A vulnerability in the serialize-javascript library can allow an attacker to crash or freeze an application by causing it to consume 100% of its CPU. This library is commonly used to convert JavaScript objects into a format that can be sent over a network or stored. If an attacker can provide a specially crafted object to be processed, they can cause a denial-of-service condition, making the application unavailable to legitimate users.

Technologies: [serialize-javascript (npm)](https://junglewise.ai/threats/technologies/serialize-javascript). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-34043 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34043 being exploited in the wild.

**How severe is CVE-2026-34043?** Medium severity, with a CVSS score of 5.9, published 27 March 2026.

**Which products and versions are affected?** serialize-javascript (npm) >= 5.0.0, < 7.0.5, SEMVER:introduced=5.0.0,fixed=7.0.5.

**Is there a fix for CVE-2026-34043?** Yes. serialize-javascript (npm): upgrade to 7.0.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-34043 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-34043?** Check whether you run serialize-javascript (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- serialize-javascript (npm): upgrade to 7.0.5 or later

  ```sh
  npm install serialize-javascript@7.0.5
  ```


## Technical details

A Denial of Service (DoS) vulnerability exists in serialize-javascript due to uncontrolled resource consumption (CWE-400) and excessive iteration (CWE-834). The issue occurs when the library attempts to serialize an 'array-like' object that inherits from Array.prototype but possesses an extremely large 'length' property. This causes the serialization process to enter an intensive loop, consuming 100% CPU and hanging the process indefinitely. While the attack complexity is high, it can be triggered if the application processes untrusted data or is susceptible to prototype pollution. The vulnerability is fixed in version 7.0.5 by replacing 'instanceof Array' checks with 'Array.isArray()' and utilizing 'Object.keys()' for sparse array detection.

## Affected products

- yahoo serialize-javascript >= 5.0.0, < 7.0.5

## Identifiers

- CVE-2026-34043
- GHSA-qj8w-gfj5-8c6v

## Timeline

- 2026-03-25: patched: Initial patch release v7.0.5
- 2026-03-27: advisory: GitHub Advisory published

## References

- [https://api.github.com/users/TomerAberbach](https://api.github.com/users/TomerAberbach)
- [https://github.com/TomerAberbach](https://github.com/TomerAberbach)
- [https://api.github.com/users/TomerAberbach/gists%7B/gist_id%7D](https://api.github.com/users/TomerAberbach/gists%7B/gist_id%7D)
- [https://api.github.com/users/TomerAberbach/repos](https://api.github.com/users/TomerAberbach/repos)
- [https://avatars.githubusercontent.com/u/23299544?v=4](https://avatars.githubusercontent.com/u/23299544?v=4)
- [https://api.github.com/users/TomerAberbach/events%7B/privacy%7D](https://api.github.com/users/TomerAberbach/events%7B/privacy%7D)

## Related threats

- [Yahoo Serialize JavaScript XSS via unescaped script tag in function body](https://junglewise.ai/threats/cve-2026-115897-serialize-javascript-serializes-javascript-values-to-a-superset)
- [serialize-javascript cross-site scripting via unescaped script tag](https://junglewise.ai/threats/cve-2026-115754-serialize-javascript-from-7-0-1-before-7-1-3-contains-a-cross)
- [serialize-javascript XSS via script-closing tag bypass in functions](https://junglewise.ai/threats/cve-2026-97711-serialize-javascript-serializes-javascript-values-to-a-superset)
- [serialize-javascript code injection via RegExp.flags and Date.toISOString](https://junglewise.ai/threats/serialize-javascript-code-injection-via-regexp-flags-and-date-a4d4abae)
- [Yahoo serialize-javascript XSS in object serialization](https://junglewise.ai/threats/cve-2024-11831-yahoo-serialize-javascript-xss-in-object-serialization)