CVE-2026-24006: high-severity vulnerability in lxsmnsyc seroval
Seroval affected by Denial of Service via Deeply Nested Objects
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.5epss 0.4%
Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0
and below, serialization of objects with extreme depth can exceed the maximum call stack limit. In version 1.4.1, Seroval introduces a `depthLimit` parameter in serialization/deserialization methods. An error will be thrown if the depth limit is reached.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
lxsmnsyc · serovalRelated CVEs — lxsmnsyc seroval
In the same product, most dangerous first.
CVE-2026-59940CRITICALSeroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserializationEPSS 0.8%CVE-2026-23737HIGHseroval Affected by Remote Code Execution via JSON DeserializationEPSS 0.6%CVE-2026-23956HIGHseroval affected by Denial of Service via RegExp serializationEPSS 0.5%CVE-2026-116581HIGHSeroval: fromJSON deserializer trusts sequence doneAt (unauthenticated event-loop DoS)EPSS 0.5%CVE-2026-23957HIGHseroval is vulnerable to Denial of Service via array serializationEPSS 0.4%CVE-2026-104845HIGHSeroval: Memory exhaustion via unchecked TypedArray length in JSON deserializationEPSS 0.4%