CVE-2026-116581

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON and fromCrossJSON do not validate a sequence node's done index. A crafted done index can create an iterator that never finishes when application code consumes it to completion. An unauthenticated request to a service that deserializes untrusted input can therefore block the event loop, exhaust process memory, or make the service unavailable. This issue is fixed in version 1.6.8.

• CWE-835
• CWE-1284

• https://github.com/lxsmnsyc/seroval/commit/e176f9267e59ddd6c9de89cc9fe85c5b37a5b728
• https://github.com/lxsmnsyc/seroval/releases/tag/seroval@1.6.8
• https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-97r2-qh9m-474h

Published

Oct 26, 2026

Last Modified

Oct 26, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-116576systeminformation is a System and OS information library for…7.8
• CVE-2026-116577Tornado is a Python web framework and asynchronous networkin…5.3
• CVE-2026-116578Tornado is a Python web framework and asynchronous networkin…2.1
• CVE-2026-116579Autobahn Python is a WebSocket and WAMP implementation for P…5.9
• CVE-2026-11658Insufficient validation of untrusted input in Extensions in …6.5
• CVE-2026-116580Seroval facilitates JavaScript value stringification, includ…7.3
• CVE-2026-116582Seroval facilitates JavaScript value stringification, includ…4.7
• CVE-2026-116583Seroval facilitates JavaScript value stringification, includ…5.3
• CVE-2026-116584Seroval facilitates JavaScript value stringification, includ…7.5
• CVE-2026-116585Go JOSE provides an implementation of the Javascript Object …6.9
• CVE-2026-116586Go JOSE provides an implementation of the Javascript Object …6.9
• CVE-2026-116587Go JOSE provides an implementation of the Javascript Object …7.5