CVE-2026-104845 · GHSA-jp82-f5mq-hwhp

Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization

Risk score: 62/100
CVSS: 7.5 v3.1
Exploit chance (30 days): 0.4%
Published: 2 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.3, deserializeTypedArray in fromJSON and fromCrossJSON trusts a deserialized source value as an ArrayBuffer and does not bound the serialized element count. An attacker can provide a small untrus…
Affected: seroval (npm) <= 1.6.2
Fix: Upgrade seroval to 1.6.3 or later.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

seroval: Amber, patch this week. Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. From 0.12.0 until 1.6.2, fromJSON deserialization of a fulfilled Promise control node can pass a plugin-produced callable-bearing thenable to a native Promise resolver. ECMAScript thenable assimilation then i…

The flaws

CVE-2026-104845: Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization (CVSS 7.5 · EPSS 0%)
CVE-2026-104846: Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw) (CVSS 9.8 · EPSS 0%)

The fix

Upgrade seroval: 1.6.3 · 1.6.2 or later on your release line

Who is exposed: seroval (npm) >= 0.12.0, <= 1.6.0

Where it stands

No known exploitation

Connects to

Same weakness: Denial of service (CWE-770). 206 other warnings in 30 days

Why it is Amber

CVSS 7.5 high
Remotely exploitable without logging in
On your watchlist: npm

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
seroval	npm	<= 1.6.2	1.6.3

References

Original description

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.3, deserializeTypedArray in fromJSON and fromCrossJSON trusts a deserialized source value as an ArrayBuffer and does not bound the serialized element count. An attacker can provide a small untrusted JSON object with a large length value, causing the array-like TypedArray constructor to synchronously allocate the selected number of elements and exhaust CPU or memory while starving the event loop. The offset check does not reject the crafted source because source.byteLength is undefined. DataView reaches a similar unchecked cast but throws rather than allocating, and the issue has no identified confidentiality or integrity impact. This issue is fixed in version 1.6.3.

Last activity 2 Oct 2026. Patch Forecast updates every hour.