CVE-2026-116581 Seroval: fromJSON deserializer trusts sequence doneAt (unauthenticated event-loop DoS)
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-116581?
CVE-2026-116581 is a high-severity vulnerability in lxsmnsyc seroval, published on 26 Oct 2026.
Official description
Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON and fromCrossJSON do not validate a sequence node's done index. A crafted done index can create an iterator that never finishes when application code consumes it to completion. An unauthenticated request to a service that deserializes untrusted input can therefore block the event loop, exhaust process memory, or make the service unavailable. This issue is fixed in version 1.6.8.
Which versions are affected by CVE-2026-116581?
2 open source packages ship an affected version, including seroval.
| Package | Affected | Fixed in |
|---|---|---|
seroval npm | All versions | 1.6.8 |
seroval npm | All versions | 1.6.8 |
How do I fix CVE-2026-116581?
Upgrade seroval to 1.6.8 or later.
Is CVE-2026-116581 being exploited?
There is no known exploitation of CVE-2026-116581 in the wild and no public exploit code.
Sources
Also known as GHSA-97r2-qh9m-474h.