Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS)

影響: npm:seroval <= 1.6.7 → 1.6.8

fromJSON and fromCrossJSON used two node fields without checking them. - An array node's element list was not checked to be an array. A small payload could set the length the decoder looped over. This part is also tracked in GHSA-wp97-x4hv-qvhp. - A sequence node's done index was not checked. A crafted value produced an iterator that never finished. Impact A service that passes untrusted input to fromJSON or fromCrossJSON can be made unavailable by an unauthenticated request. - The array case b…

GitHub Advisory Database에서 읽기

2026. 10. 29. 오전 06:17, GitHub Advisory Database에서 "Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS)"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "높음"(high)입니다. 관련 기술: JavaScript / Node.js. CVE: CVE-2026-116581.