{"id":"ghsa-ghsa-97r2-qh9m-474h","seq":2056915,"kind":"advisory","title":"Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS)","url":"https://github.com/advisories/GHSA-97r2-qh9m-474h","permalink":"https://vulnpulse.app/items/ghsa-ghsa-97r2-qh9m-474h","summary":"影響: npm:seroval <= 1.6.7 → 1.6.8\nfromJSON and fromCrossJSON used two node fields without checking them. - An array node's element list was not checked to be an array. A small payload could set the length the decoder looped over. This part is also tracked in GHSA-wp97-x4hv-qvhp. - A sequence node's done index was not checked. A crafted value produced an iterator that never finished. Impact A service that passes untrusted input to fromJSON or fromCrossJSON can be made unavailable by an unauthenticated request. - The array case b…","severity":"high","techs":["nodejs"],"cves":["CVE-2026-116581"],"tags":["GHSA-97r2-qh9m-474h","seroval"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-28T21:17:27.000Z","fetched_at":"2026-10-29T00:48:52.653Z"}