{"id":"EUVD-2026-110367","enisaUuid":"a68d0ee8-17d2-36f1-9a63-aa4f68dfec10","description":"Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON and fromCrossJSON do not validate a sequence node\u0027s done index. A crafted done index can create an iterator that never finishes when application code consumes it to completion. An unauthenticated request to a service that deserializes untrusted input can therefore block the event loop, exhaust process memory, or make the service unavailable. This issue is fixed in version 1.6.8.","datePublished":"Oct 26, 2026, 8:41:52 PM","dateUpdated":"Oct 26, 2026, 8:41:52 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-97r2-qh9m-474h\nhttps://github.com/lxsmnsyc/seroval/commit/e176f9267e59ddd6c9de89cc9fe85c5b37a5b728\nhttps://github.com/lxsmnsyc/seroval/releases/tag/seroval@1.6.8\n","aliases":"CVE-2026-116581\n","assigner":"GitHub_M","epss":0.45,"enisaIdProduct":[{"id":"464ee04f-6b42-38a9-923e-528a7fe5f18f","product":{"name":"seroval","vendor":{"name":"lxsmnsyc"}},"product_version":"\u003c 1.6.8"}],"enisaIdVendor":[{"id":"32d86068-d5a6-315b-ab55-e08cdcd76b42","vendor":{"name":"lxsmnsyc"}}],"enisaIdVulnerability":[{"id":"3a3f13c8-858d-3a59-b963-a8fd6858afe0","vulnerability":{"id":"CVE-2026-116581","description":"Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON and fromCrossJSON do not validate a sequence node\u0027s done index. A crafted done index can create an iterator that never finishes when application code consumes it to completion. An unauthenticated request to a service that deserializes untrusted input can therefore block the event loop, exhaust process memory, or make the service unavailable. This issue is fixed in version 1.6.8.","datePublished":"Oct 26, 2026, 8:41:52 PM","dateUpdated":"Oct 26, 2026, 8:41:52 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-97r2-qh9m-474h\nhttps://github.com/lxsmnsyc/seroval/commit/e176f9267e59ddd6c9de89cc9fe85c5b37a5b728\nhttps://github.com/lxsmnsyc/seroval/releases/tag/seroval@1.6.8\n","enisa_id":"EUVD-2026-110367\n","assigner":"GitHub_M","epss":0.45,"dataProcessed":"Oct 28, 2026, 11:00:58 PM","vulnerabilityProduct":[{"id":"a2acfac7-1c58-3614-a08d-f7d5dccba58b","product":{"name":"seroval","vendor":{"name":"lxsmnsyc"}},"product_version":"\u003c 1.6.8"}],"vulnerabilityVendor":[{"id":"388eaed0-ff45-336a-acb6-509e9fa99800","vendor":{"name":"lxsmnsyc"}}]}}],"enisaIdAdvisory":[]}