CVE-2026-104845

Name of the Vulnerable Software and Affected Versions Seroval versions prior to 1.6.3

Description Seroval allows for the stringification of JavaScript values, including complex structures. The deserializeTypedArray function within fromJSON and fromCrossJSON trusts a deserialized source value as an ArrayBuffer without bounding the serialized element count. An attacker can provide a small untrusted JSON object containing a large length value, which forces the TypedArray constructor to synchronously allocate a massive number of elements. This process can exhaust CPU or memory resources and starve the event loop, leading to a denial of service. The offset check fails to reject the crafted source because source.byteLength is undefined. While DataView encounters a similar unchecked cast, it throws an error instead of allocating memory.

Recommendations Update Seroval to version 1.6.3.