CVE-2026-116584

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.4.1 until 1.6.8, fromJSON and fromCrossJSON do not require an array node's element list to be an actual array. A small crafted payload can supply an attacker-controlled length that determines memory allocation and decoder iterations independently of payload size, allowing an unauthenticated request to exhaust the process or block its thread. This issue is a residual bypass of the remediation for CVE-2026-23957. This issue is fixed in version 1.6.8.

• CWE-770

• https://github.com/lxsmnsyc/seroval/commit/cdcee3e3bc384ee844360844f8ea98fd2b275d69
• https://github.com/lxsmnsyc/seroval/releases/tag/seroval@1.6.8
• https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-wp97-x4hv-qvhp

Published

Oct 26, 2026

Last Modified

Oct 26, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-116579Autobahn Python is a WebSocket and WAMP implementation for P…5.9
• CVE-2026-11658Insufficient validation of untrusted input in Extensions in …6.5
• CVE-2026-116580Seroval facilitates JavaScript value stringification, includ…7.3
• CVE-2026-116581Seroval facilitates JavaScript value stringification, includ…7.5
• CVE-2026-116582Seroval facilitates JavaScript value stringification, includ…4.7
• CVE-2026-116583Seroval facilitates JavaScript value stringification, includ…5.3
• CVE-2026-116585Go JOSE provides an implementation of the Javascript Object …6.9
• CVE-2026-116586Go JOSE provides an implementation of the Javascript Object …6.9
• CVE-2026-116587Go JOSE provides an implementation of the Javascript Object …7.5
• CVE-2026-116588Datadog dd-trace-py is the Datadog Python APM client. From 1…8.7
• CVE-2026-116589Datadog dd-trace-py is the Datadog Python APM client. From 3…8.2
• CVE-2026-11659Integer overflow in UI in Google Chrome on Linux prior to 14…9.6