Skip to content
OpenAdvisories
High · 7.5 CVE-2026-24006 EUVD-2026-4134GHSA-3j22-8qj3-26mx

Seroval affected by Denial of Service via Deeply Nested Objects

Published Jan 22, 2026 · Updated Jan 22, 2026 · Assigned by GitHub_M

Description

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0
and below, serialization of objects with extreme depth can exceed the maximum call stack limit. In version 1.4.1, Seroval introduces a `depthLimit` parameter in serialization/deserialization methods. An error will be thrown if the depth limit is reached.

Affected products

VendorProductAffectedFixed
lxsmnsyc seroval < 1.4.1 —

Affected packages

EcosystemPackageAffectedFixedRecord
npm seroval < 1.4.1 1.4.1 GHSA-3j22-8qj3-26mx

References